{"id":"91e1c1a8d76c782b","repo":"docker/cli","slug":"unknown-role-s","errorCode":null,"errorMessage":"unknown role %s","messagePattern":"unknown role (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/join_token.go","lineNumber":50,"sourceCode":"\t\t\t\"version\": \"1.24\",\n\t\t\t\"swarm\":   \"manager\",\n\t\t},\n\t\tDisableFlagsInUseLine: true,\n\t}\n\n\tflags := cmd.Flags()\n\tflags.BoolVar(&opts.rotate, flagRotate, false, \"Rotate join token\")\n\tflags.BoolVarP(&opts.quiet, flagQuiet, \"q\", false, \"Only display token\")\n\n\treturn cmd\n}\n\nfunc runJoinToken(ctx context.Context, dockerCLI command.Cli, opts joinTokenOptions) error {\n\tworker := opts.role == \"worker\"\n\tmanager := opts.role == \"manager\"\n\n\tif !worker && !manager {\n\t\treturn errors.New(\"unknown role \" + opts.role)\n\t}\n\n\tapiClient := dockerCLI.Client()\n\n\tif opts.rotate {\n\t\tres, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\t\tVersion:            res.Swarm.Version,\n\t\t\tSpec:               res.Swarm.Spec,\n\t\t\tRotateWorkerToken:  worker,\n\t\t\tRotateManagerToken: manager,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/join_token.go#L32-L68","documentation":"Returned by `docker swarm join-token` when the positional ROLE argument is neither \"worker\" nor \"manager\". The command only knows how to fetch or rotate join tokens for these two swarm roles, so any other value is rejected before any API call is made.","triggerScenarios":"Invoking `docker swarm join-token <role>` with a role other than the exact lowercase strings \"worker\" or \"manager\" — e.g. `docker swarm join-token node`, `docker swarm join-token Manager`, a typo like `worekr`, or an empty/scripted variable that expanded to something else.","commonSituations":"Shell scripts interpolating an unset or misspelled variable for the role; users guessing role names like \"leader\", \"master\", or \"node\"; capitalization mistakes since the comparison is case-sensitive.","solutions":["Use exactly `docker swarm join-token worker` or `docker swarm join-token manager` (lowercase).","In scripts, validate the role variable against the two allowed values before calling the CLI.","Add `-q` if you only need the token string, and `--rotate` to invalidate the old token."],"exampleFix":"# before\ndocker swarm join-token Master\n# after\ndocker swarm join-token manager","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker","swarm","cli-usage","validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}