code: func updateCredSpecConfig(flags *pflag.FlagSet, containerSpec *swarm.ContainerSpec) {
  	if flags.Changed(flagCredentialSpec) {
  		credSpecOpt := flags.Lookup(flagCredentialSpec)
  		// if the flag has changed, and the value is empty string, then we
  		// should remove any credential spec that might be present
  		if credSpecOpt.Value.String() == "" {
  			if containerSpec.Privileges != nil {
  				containerSpec.Privileges.CredentialSpec = nil
  			}
  			return
  		}
  
  		// otherwise, set the credential spec to be the parsed value
  		credSpec := credSpecOpt.Value.(*credentialSpecOpt).Value()
  
  		// if this is a Config credential spec, we we still need to replace the
  		// value of credSpec.Config with the config ID instead of Name.
  		if credSpec.Config != "" {
  			for _, config := range containerSpec.Configs {
  				// if the config name matches, then set the config ID. we do
  				// not need to worry about if this is a Runtime target or not.
  				// even if it is not a Runtime target, getUpdatedConfigs
  				// ensures that a Runtime target for this config exists, and
  				// the Name is unique so the ID is correct no matter the
  				// target.
  				if config.ConfigName == credSpec.Config {
  					credSpec.Config = config.ConfigID
  					break
  				}
  			}
  		}
  
  		if containerSpec.Privileges == nil {
  			containerSpec.Privileges = &swarm.Privileges{}
  		}
  
  		containerSpec.Privileges.CredentialSpec = credSpec
  	}
  }
docs: // updateCredSpecConfig updates the value of the credential spec Config field
  // to the config ID if the credential spec has changed. it mutates the passed
  // spec. it does not handle the case where the credential spec specifies a
  // config that does not exist -- that case is handled as part of
  // getUpdatedConfigs