diff --git a/build/terraform b/build/terraform
index 7c404ed529b9..a0fb67e68c6d 160000
--- a/build/terraform
+++ b/build/terraform
@@ -1 +1 @@
-Subproject commit 7c404ed529b9841cb54980d45358c840559bdd38
+Subproject commit a0fb67e68c6d0d91af90657dfabd9e2f2741c4bf
diff --git a/build/terraform-beta b/build/terraform-beta
index 33dc4444cd6d..8d3bdd31d309 160000
--- a/build/terraform-beta
+++ b/build/terraform-beta
@@ -1 +1 @@
-Subproject commit 33dc4444cd6de407482f0f1cbe1ba6ac7e682337
+Subproject commit 8d3bdd31d3092eb0b0791d1c4ffa878c9fd01a76
diff --git a/third_party/terraform/website/docs/version_3_upgrade.html.markdown b/third_party/terraform/website/docs/version_3_upgrade.html.markdown
index 201bcc10dce5..62a5a1e002e2 100644
--- a/third_party/terraform/website/docs/version_3_upgrade.html.markdown
+++ b/third_party/terraform/website/docs/version_3_upgrade.html.markdown
@@ -123,6 +123,23 @@ logging_service    = "logging.googleapis.com/kubernetes"
 monitoring_service = "monitoring.googleapis.com/kubernetes"
 ```
 
+### `taint` field is now authoritative when set
+
+The `taint` field inside of `node_config` blocks on `google_container_cluster`
+and `google_container_node_pool` will no longer ignore GPU-related values when
+set.
+
+Previously, the field ignored upstream taints when unset and ignored unset GPU
+taints when other taints were set. Now it will ignore upstream taints when set
+and act authoritatively when set, requiring all taints (including Kubernetes and
+GKE-managed ones) to be defined in config.
+
+Additionally, an empty taint can now be specified with `taint = []`. As a result
+of this change, the JSON/state representation of the field has changed,
+introducing an incompatibility for users who specify config in JSON instead of
+HCL or who use `dynamic` blocks. See more details in the [Attributes as Blocks](https://www.terraform.io/docs/configuration/attr-as-blocks.html)
+documentation.
+
 ## Resource: `google_project_services`
 
 ### `google_project_services` has been removed from the provider