diff --git a/google/resource_container_cluster.go b/google/resource_container_cluster.go
index fc6e515a..a3355b59 100644
--- a/google/resource_container_cluster.go
+++ b/google/resource_container_cluster.go
@@ -279,13 +279,13 @@ func resourceContainerCluster() *schema.Resource {
 					Schema: map[string]*schema.Schema{
 						"password": {
 							Type:      schema.TypeString,
-							Required:  true,
+							Optional:  true,
 							Sensitive: true,
 						},
 
 						"username": {
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
 						},
 
 						"client_certificate_config": {
diff --git a/website/docs/r/container_cluster.html.markdown b/website/docs/r/container_cluster.html.markdown
index 632cfbe9..f105c2c2 100644
--- a/website/docs/r/container_cluster.html.markdown
+++ b/website/docs/r/container_cluster.html.markdown
@@ -270,11 +270,11 @@ The `ip_allocation_policy` block supports:
 
 The `master_auth` block supports:
 
-* `password` - (Required) The password to use for HTTP basic authentication when accessing
-    the Kubernetes master endpoint
+* `password` - (Optional) The password to use for HTTP basic authentication when accessing
+    the Kubernetes master endpoint.
 
-* `username` - (Required) The username to use for HTTP basic authentication when accessing
-    the Kubernetes master endpoint
+* `username` - (Optional) The username to use for HTTP basic authentication when accessing
+    the Kubernetes master endpoint. If not present basic auth will be disabled.
 
 * `client_certificate_config` - (Optional) Whether client certificate authorization is enabled for this cluster.  For example: