anchor.diff:      services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
     }
   }
  -`, containerNetName, clusterName)
  +`, containerNetName, clusterName, orgDomain)
   }
   
   func testAccContainerCluster_withMasterAuthorizedNetworksConfig(clusterName string, cidrs []string, emptyValue string) string {
  
positive.code: 	t.Parallel()
  	clusterName := fmt.Sprintf("tf-test-cluster-%s", randString(t, 10))
  	containerNetName := fmt.Sprintf("tf-test-container-net-%s", randString(t, 10))
  	vcrTest(t, resource.TestCase{
  		PreCheck:     func() { testAccPreCheck(t) },
  		Providers:    testAccProviders,
  		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
  		Steps: []resource.TestStep{
  			{
  				Config: testAccContainerCluster_withAuthenticatorGroupsConfig(containerNetName, clusterName),
  			},
  			{
  				ResourceName:        "google_container_cluster.with_authenticator_groups",
  
negative.code:   subnetwork         = google_compute_subnetwork.container_subnetwork.name
  
    authenticator_groups_config {
      security_group = "gke-security-groups-test@%s"
    }
  
  <% unless version == 'ga' -%>
  