anchor.diff:    subnetwork         = google_compute_subnetwork.container_subnetwork.name
   
     authenticator_groups_config {
  -    security_group = "gke-security-groups@mydomain.tld"
  +    security_group = "gke-security-groups-test@%s"
     }
   
   <% unless version == 'ga' -%>
  
positive.code: 	t.Parallel()
  	clusterName := fmt.Sprintf("tf-test-cluster-%s", randString(t, 10))
  	containerNetName := fmt.Sprintf("tf-test-container-net-%s", randString(t, 10))
  	vcrTest(t, resource.TestCase{
  		PreCheck:     func() { testAccPreCheck(t) },
  		Providers:    testAccProviders,
  		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
  		Steps: []resource.TestStep{
  			{
  				Config: testAccContainerCluster_withAuthenticatorGroupsConfig(containerNetName, clusterName),
  			},
  			{
  				ResourceName:        "google_container_cluster.with_authenticator_groups",
  
negative.code: `, clusterName)
  }
  
  func testAccContainerCluster_withAuthenticatorGroupsConfig(containerNetName string, clusterName string, orgDomain string) string {
  	return fmt.Sprintf(`
  resource "google_compute_network" "container_network" {
    name                    = "%s"
  