code: func (c *testCluster) AddManager(lateBind bool, rootCA *ca.RootCA) error {
  	// first node
  	var n *testNode
  	if len(c.nodes) == 0 {
  		node, err := newTestNode("", "", lateBind, c.fips)
  		if err != nil {
  			return err
  		}
  		// generate TLS certs for this manager for bootstrapping, else the node will generate its own CA
  		if rootCA != nil {
  			if err := generateCerts(node.stateDir, rootCA, identity.NewID(), ca.ManagerRole, identity.NewID(), true); err != nil {
  				return err
  			}
  		}
  		n = node
  	} else {
  		lateBind = false
  		joinAddr, err := c.RandomManager().node.RemoteAPIAddr()
  		if err != nil {
  			return err
  		}
  		clusterInfo, err := c.GetClusterInfo()
  		if err != nil {
  			return err
  		}
  		node, err := newTestNode(joinAddr, clusterInfo.RootCA.JoinTokens.Manager, false, c.fips)
  		if err != nil {
  			return err
  		}
  		n = node
  	}
  
  	if err := c.AddNode(n); err != nil {
  		return err
  	}
  
  	if lateBind {
  		// Verify that the control API works
  		if _, err := c.GetClusterInfo(); err != nil {
  			return err
  		}
  		return n.node.BindRemote(context.Background(), "127.0.0.1:0", "")
  	}
  
  	return nil
  }
docs: // AddManager adds a node with the Manager role. The node will function as both
  // an agent and a manager. If lateBind is set, the manager is started before a
  // remote API port is bound. If rootCA is set, the manager is bootstrapped using
  // said root CA.  These settings only apply to the first manager.