prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Check: CKV_GCP_19 False positive
  **Describe the bug**
  Checkov Will flag your code even if the `basic-auth` is already disabled on your cluster.
  **To Reproduce**
  Steps to reproduce the behavior:
  1. Have a file as follows:
  ``` 
  resource "google_container_cluster" "cluster-test" {
    name     = "cluster-test"
    location = "europe-west1-c"
    provider = google-beta
  
    remove_default_node_pool = true
    initial_node_count       = 1
  
    enable_shielded_nodes = true
  
    release_channel {
      channel = "RAPID"
    }
  
    pod_security_policy_config {
      enabled = true
    }
  
    master_auth {
      username = ""
      password = ""
  
      client_certificate_config {
        issue_client_certificate = false
      }
    }
  }
  ``` 
  2. Run cli command  'checkov -d path/to/your/terraform/folder.'
  3. See error:
  ``` 
  Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
  	FAILED for resource: google_container_cluster.cluster-test
  	File: /cluster.tf:1-27
  	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11
  
  		1  | resource "google_container_cluster" "cluster-test" {
  		2  |   name     = "cluster-test"
  		3  |   location = "europe-west1-c"
  		4  |   provider = google-beta
  		5  | 
  		6  |   remove_default_node_pool = true
  		7  |   initial_node_count       = 1
  		8  | 
  		9  |   enable_shielded_nodes = true
  		10 | 
  		11 |   release_channel {
  		12 |     channel = "RAPID"
  		13 |   }
  		14 | 
  		15 |   pod_security_policy_config {
  		16 |     enabled = true
  		17 |   }
  		18 | 
  		19 |   master_auth {
  		20 |     username = ""
  		21 |     password = ""
  		22 | 
  		23 |     client_certificate_config {
  		24 |       issue_client_certificate = false
  		25 |     }
  		26 |   }
  		27 | }
  ``` 
  
  **Expected behavior**
  ``` 
  Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
  	PASSED for resource: google_container_cluster.cluster-test
  	File: /cluster.tf:1-27
  	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7
  ``` 
  
  The `basic-auth` is already supposed to be disabled using this bit of code as:
  ```  
    master_auth {
      username = ""
      password = ""
  
      client_certificate_config {
        issue_client_certificate = false
      }
    }
  ```
  
  **Environment:**
   - CI: Github Actions 
   - OS: Ubuntu-lastest
   - Checkov Version [latest]
   - Terraform v0.12.24
  
  **Additional context**
  Tested and installed today following documentation available here: https://www.checkov.io/1.Introduction/Getting%20Started.html
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/gcp/GKEBasicAuth.py]
  1 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  2 from checkov.common.models.enums import CheckResult, CheckCategories
  3 
  4 
  5 class GKEBasicAuth(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure GKE basic auth is disabled"
  8         id = "CKV_GCP_19"
  9         supported_resources = ['google_container_cluster']
  10         categories = [CheckCategories.KUBERNETES]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def scan_resource_conf(self, conf):
  14         """
  15             Looks for password configuration at azure_instance:
  16             https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html
  17         :param conf: google_compute_ssl_policy configuration
  18         :return: <CheckResult>
  19         """
  20         if 'master_auth' in conf.keys():
  21             if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
  22                 return CheckResult.FAILED
  23             return CheckResult.PASSED
  24         return CheckResult.FAILED
  25 
  26 
  27 check = GKEBasicAuth()
  28
  [end of checkov/terraform/checks/resource/gcp/GKEBasicAuth.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
  --- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
  +++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
  @@ -1,5 +1,5 @@
  -from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
   from checkov.common.models.enums import CheckResult, CheckCategories
  +from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
   
   
   class GKEBasicAuth(BaseResourceCheck):
  @@ -18,7 +18,13 @@
           :return: <CheckResult>
           """
           if 'master_auth' in conf.keys():
  -            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
  +            username = conf['master_auth'][0].get('username')
  +            password = conf['master_auth'][0].get('password')
  +            if username or password:
  +                # only if both are set to the empty string it is fine
  +                # https://www.terraform.io/docs/providers/google/r/container_cluster.html
  +                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':
  +                    return CheckResult.PASSED
                   return CheckResult.FAILED
               return CheckResult.PASSED
           return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n--- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n+++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n@@ -1,5 +1,5 @@\n-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n from checkov.common.models.enums import CheckResult, CheckCategories\n+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n \n \n class GKEBasicAuth(BaseResourceCheck):\n@@ -18,7 +18,13 @@\n         :return: <CheckResult>\n         \"\"\"\n         if 'master_auth' in conf.keys():\n-            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):\n+            username = conf['master_auth'][0].get('username')\n+            password = conf['master_auth'][0].get('password')\n+            if username or password:\n+                # only if both are set to the empty string it is fine\n+                # https://www.terraform.io/docs/providers/google/r/container_cluster.html\n+                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':\n+                    return CheckResult.PASSED\n                 return CheckResult.FAILED\n             return CheckResult.PASSED\n         return CheckResult.FAILED\n", "issue": "Check: CKV_GCP_19 False positive\n**Describe the bug**\r\nCheckov Will flag your code even if the `basic-auth` is already disabled on your cluster.\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Have a file as follows:\r\n``` \r\nresource \"google_container_cluster\" \"cluster-test\" {\r\n  name     = \"cluster-test\"\r\n  location = \"europe-west1-c\"\r\n  provider = google-beta\r\n\r\n  remove_default_node_pool = true\r\n  initial_node_count       = 1\r\n\r\n  enable_shielded_nodes = true\r\n\r\n  release_channel {\r\n    channel = \"RAPID\"\r\n  }\r\n\r\n  pod_security_policy_config {\r\n    enabled = true\r\n  }\r\n\r\n  master_auth {\r\n    username = \"\"\r\n    password = \"\"\r\n\r\n    client_certificate_config {\r\n      issue_client_certificate = false\r\n    }\r\n  }\r\n}\r\n``` \r\n2. Run cli command  'checkov -d path/to/your/terraform/folder.'\r\n3. See error:\r\n``` \r\nCheck: CKV_GCP_19: \"Ensure GKE basic auth is disabled\"\r\n\tFAILED for resource: google_container_cluster.cluster-test\r\n\tFile: /cluster.tf:1-27\r\n\tGuide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11\r\n\r\n\t\t1  | resource \"google_container_cluster\" \"cluster-test\" {\r\n\t\t2  |   name     = \"cluster-test\"\r\n\t\t3  |   location = \"europe-west1-c\"\r\n\t\t4  |   provider = google-beta\r\n\t\t5  | \r\n\t\t6  |   remove_default_node_pool = true\r\n\t\t7  |   initial_node_count       = 1\r\n\t\t8  | \r\n\t\t9  |   enable_shielded_nodes = true\r\n\t\t10 | \r\n\t\t11 |   release_channel {\r\n\t\t12 |     channel = \"RAPID\"\r\n\t\t13 |   }\r\n\t\t14 | \r\n\t\t15 |   pod_security_policy_config {\r\n\t\t16 |     enabled = true\r\n\t\t17 |   }\r\n\t\t18 | \r\n\t\t19 |   master_auth {\r\n\t\t20 |     username = \"\"\r\n\t\t21 |     password = \"\"\r\n\t\t22 | \r\n\t\t23 |     client_certificate_config {\r\n\t\t24 |       issue_client_certificate = false\r\n\t\t25 |     }\r\n\t\t26 |   }\r\n\t\t27 | }\r\n``` \r\n\r\n**Expected behavior**\r\n``` \r\nCheck: CKV_GCP_19: \"Ensure GKE basic auth is disabled\"\r\n\tPASSED for resource: google_container_cluster.cluster-test\r\n\tFile: /cluster.tf:1-27\r\n\tGuide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7\r\n``` \r\n\r\nThe `basic-auth` is already supposed to be disabled using this bit of code as:\r\n```  \r\n  master_auth {\r\n    username = \"\"\r\n    password = \"\"\r\n\r\n    client_certificate_config {\r\n      issue_client_certificate = false\r\n    }\r\n  }\r\n```\r\n\r\n**Environment:**\r\n - CI: Github Actions \r\n - OS: Ubuntu-lastest\r\n - Checkov Version [latest]\r\n - Terraform v0.12.24\r\n\r\n**Additional context**\r\nTested and installed today following documentation available here: https://www.checkov.io/1.Introduction/Getting%20Started.html\n", "before_files": [{"content": "from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass GKEBasicAuth(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure GKE basic auth is disabled\"\n        id = \"CKV_GCP_19\"\n        supported_resources = ['google_container_cluster']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for password configuration at azure_instance:\n            https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html\n        :param conf: google_compute_ssl_policy configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'master_auth' in conf.keys():\n            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = GKEBasicAuth()\n", "path": "checkov/terraform/checks/resource/gcp/GKEBasicAuth.py"}]}