diff --git a/go.mod b/go.mod
index 1633dfaf..f70c3c71 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/mcuadros/go-version v0.0.0-20180611085657-6d5863ca60fa
 	github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c // indirect
 	github.com/pkg/errors v0.8.1
-	github.com/rancher/norman v0.0.0-20200211155126-fc45a55d4dfd
+	github.com/rancher/norman v0.0.0-20200312033725-5c74e1ee1e6d
 	github.com/rancher/types v0.0.0-20200303162837-300a04e6f743
 	github.com/sirupsen/logrus v1.4.2
 	github.com/stretchr/testify v1.4.0
diff --git a/go.sum b/go.sum
index 1bf6cd36..127dae96 100644
--- a/go.sum
+++ b/go.sum
@@ -634,6 +634,8 @@ github.com/prometheus/prometheus v1.8.2-0.20200107122003-4708915ac6ef/go.mod h1:
 github.com/prometheus/prometheus v2.3.2+incompatible/go.mod h1:oAIUtOny2rjMX0OWN5vPR5/q/twIROJvdqnQKDdil/s=
 github.com/rancher/norman v0.0.0-20200211155126-fc45a55d4dfd h1:96iahn2n4qq7EuJ6QNrW2iqm1xVUktzjHSyNPPm/6YU=
 github.com/rancher/norman v0.0.0-20200211155126-fc45a55d4dfd/go.mod h1:b+483H276jRBXYosdWrNKFpxH+JYMs3UIdlV60dhdg0=
+github.com/rancher/norman v0.0.0-20200312033725-5c74e1ee1e6d h1:XrZkPfanv6m1OcnqUzXqn4GmLA7vJ6eHJF7VGDl5ses=
+github.com/rancher/norman v0.0.0-20200312033725-5c74e1ee1e6d/go.mod h1:b+483H276jRBXYosdWrNKFpxH+JYMs3UIdlV60dhdg0=
 github.com/rancher/pkg v0.0.0-20190514055449-b30ab9de040e h1:j6+HqCET/NLPBtew2m5apL7jWw/PStQ7iGwXjgAqdvo=
 github.com/rancher/pkg v0.0.0-20190514055449-b30ab9de040e/go.mod h1:XbYHTPaXuw8ZY9bylhYKQh/nJxDaTKk3YhAxPl4Qy/k=
 github.com/rancher/types v0.0.0-20200303162837-300a04e6f743 h1:DwM6Wx7mJ95RjcdO9aAOGd4xjeCCeK0nKBKsnTGsFYA=
diff --git a/vendor/github.com/rancher/norman/controller/cluster_check.go b/vendor/github.com/rancher/norman/controller/cluster_check.go
index 0389ddfd..f6cf7c67 100644
--- a/vendor/github.com/rancher/norman/controller/cluster_check.go
+++ b/vendor/github.com/rancher/norman/controller/cluster_check.go
@@ -1,12 +1,58 @@
 package controller
 
 import (
+	"os"
 	"reflect"
 	"strings"
+
+	"github.com/sirupsen/logrus"
+	corev1 "k8s.io/api/core/v1"
 )
 
+type ObjectClusterName interface {
+	ObjClusterName() string
+}
+
 func ObjectInCluster(cluster string, obj interface{}) bool {
+	// Check if the object implements the interface, this is best case and
+	// what objects should strive to be
+	if o, ok := obj.(ObjectClusterName); ok {
+		return o.ObjClusterName() == cluster
+	}
+
+	// For types outside of rancher, attempt to check the anno, then use the namespace
+	// This is much better than using the reflect hole below
+	switch v := obj.(type) {
+	case *corev1.Secret:
+		if c, ok := v.Annotations["field.cattle.io/projectId"]; ok {
+			if parts := strings.SplitN(c, ":", 2); len(parts) == 2 {
+				return cluster == parts[0]
+			}
+		}
+		return v.Namespace == cluster
+	case *corev1.Namespace:
+		if c, ok := v.Annotations["field.cattle.io/projectId"]; ok {
+			if parts := strings.SplitN(c, ":", 2); len(parts) == 2 {
+				return cluster == parts[0]
+			}
+		}
+		return v.Namespace == cluster
+	case *corev1.Node:
+		if c, ok := v.Annotations["field.cattle.io/projectId"]; ok {
+			if parts := strings.SplitN(c, ":", 2); len(parts) == 2 {
+				return cluster == parts[0]
+			}
+		}
+		return v.Namespace == cluster
+	}
+
+	// Seeing this message means something needs to be done with the type, see comments above
+	if dm := os.Getenv("CATTLE_DEV_MODE"); dm != "" {
+		logrus.Errorf("ObjectClusterName not implemented by type %T", obj)
+	}
+
 	var clusterName string
+
 	if c := getValue(obj, "ClusterName"); c.IsValid() {
 		clusterName = c.String()
 	}
diff --git a/vendor/github.com/rancher/norman/controller/generic_controller.go b/vendor/github.com/rancher/norman/controller/generic_controller.go
index e2a86152..571dd949 100644
--- a/vendor/github.com/rancher/norman/controller/generic_controller.go
+++ b/vendor/github.com/rancher/norman/controller/generic_controller.go
@@ -224,14 +224,14 @@ func (g *genericController) sync(ctx context.Context) (retErr error) {
 		DeleteFunc: g.queueObject,
 	})
 
-	logrus.Debugf("Syncing %s Controller", g.name)
+	logrus.Tracef("Syncing %s Controller", g.name)
 
 	go g.informer.Run(ctx.Done())
 
 	if !cache.WaitForCacheSync(ctx.Done(), g.informer.HasSynced) {
 		return fmt.Errorf("failed to sync controller %s", g.name)
 	}
-	logrus.Debugf("Syncing %s Controller Done", g.name)
+	logrus.Tracef("Syncing %s Controller Done", g.name)
 
 	g.synced = true
 	return nil
@@ -300,7 +300,7 @@ func (g *genericController) processNextWorkItem() bool {
 	}
 	if _, ok := checkErr.(*ForgetError); err == nil || ok {
 		if ok {
-			logrus.Debugf("%v %v completed with dropped err: %v", g.name, key, err)
+			logrus.Tracef("%v %v completed with dropped err: %v", g.name, key, err)
 		}
 		g.queue.Forget(key)
 		return true
@@ -381,7 +381,7 @@ func (g *genericController) syncHandler(key interface{}) (err error) {
 			continue
 		}
 
-		logrus.Debugf("%s calling handler %s %s", g.name, handler.name, s)
+		logrus.Tracef("%s calling handler %s %s", g.name, handler.name, s)
 		metrics.IncTotalHandlerExecution(g.name, handler.name)
 		var newObj interface{}
 		if newObj, err = handler.handler(s, obj); err != nil {
diff --git a/vendor/github.com/rancher/norman/objectclient/object_client.go b/vendor/github.com/rancher/norman/objectclient/object_client.go
index 2798befc..70ca0803 100644
--- a/vendor/github.com/rancher/norman/objectclient/object_client.go
+++ b/vendor/github.com/rancher/norman/objectclient/object_client.go
@@ -127,7 +127,7 @@ func (p *ObjectClient) Create(o runtime.Object) (runtime.Object, error) {
 		}
 	}
 	result := p.Factory.Object()
-	logrus.Debugf("REST CREATE %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, ns, p.resource.Name)
+	logrus.Tracef("REST CREATE %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, ns, p.resource.Name)
 	err := p.restClient.Post().
 		Prefix(p.getAPIPrefix(), p.gvk.Group, p.gvk.Version).
 		NamespaceIfScoped(ns, p.resource.Namespaced).
@@ -151,7 +151,7 @@ func (p *ObjectClient) GetNamespaced(namespace, name string, opts metav1.GetOpti
 		Name(name).
 		Do().
 		Into(result)
-	logrus.Debugf("REST GET %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name, name)
+	logrus.Tracef("REST GET %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name, name)
 	return result, err
 
 }
@@ -166,7 +166,7 @@ func (p *ObjectClient) Get(name string, opts metav1.GetOptions) (runtime.Object,
 		Name(name).
 		Do().
 		Into(result)
-	logrus.Debugf("REST GET %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name, name)
+	logrus.Tracef("REST GET %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name, name)
 	return result, err
 }
 
@@ -179,7 +179,7 @@ func (p *ObjectClient) Update(name string, o runtime.Object) (runtime.Object, er
 	if len(name) == 0 {
 		return result, errors.New("object missing name")
 	}
-	logrus.Debugf("REST UPDATE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, ns, p.resource.Name, name)
+	logrus.Tracef("REST UPDATE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, ns, p.resource.Name, name)
 	err := p.restClient.Put().
 		Prefix(p.getAPIPrefix(), p.gvk.Group, p.gvk.Version).
 		NamespaceIfScoped(ns, p.resource.Namespaced).
@@ -197,7 +197,7 @@ func (p *ObjectClient) DeleteNamespaced(namespace, name string, opts *metav1.Del
 	if namespace != "" {
 		req = req.Namespace(namespace)
 	}
-	logrus.Debugf("REST DELETE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name, name)
+	logrus.Tracef("REST DELETE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name, name)
 	return req.Resource(p.resource.Name).
 		Name(name).
 		Body(opts).
@@ -206,7 +206,7 @@ func (p *ObjectClient) DeleteNamespaced(namespace, name string, opts *metav1.Del
 }
 
 func (p *ObjectClient) Delete(name string, opts *metav1.DeleteOptions) error {
-	logrus.Debugf("REST DELETE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name, name)
+	logrus.Tracef("REST DELETE %s/%s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name, name)
 	return p.restClient.Delete().
 		Prefix(p.getAPIPrefix(), p.gvk.Group, p.gvk.Version).
 		NamespaceIfScoped(p.ns, p.resource.Namespaced).
@@ -219,7 +219,7 @@ func (p *ObjectClient) Delete(name string, opts *metav1.DeleteOptions) error {
 
 func (p *ObjectClient) List(opts metav1.ListOptions) (runtime.Object, error) {
 	result := p.Factory.List()
-	logrus.Debugf("REST LIST %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name)
+	logrus.Tracef("REST LIST %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, p.ns, p.resource.Name)
 	return result, p.restClient.Get().
 		Prefix(p.getAPIPrefix(), p.gvk.Group, p.gvk.Version).
 		NamespaceIfScoped(p.ns, p.resource.Namespaced).
@@ -231,7 +231,7 @@ func (p *ObjectClient) List(opts metav1.ListOptions) (runtime.Object, error) {
 
 func (p *ObjectClient) ListNamespaced(namespace string, opts metav1.ListOptions) (runtime.Object, error) {
 	result := p.Factory.List()
-	logrus.Debugf("REST LIST %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name)
+	logrus.Tracef("REST LIST %s/%s/%s/%s/%s", p.getAPIPrefix(), p.gvk.Group, p.gvk.Version, namespace, p.resource.Name)
 	return result, p.restClient.Get().
 		Prefix(p.getAPIPrefix(), p.gvk.Group, p.gvk.Version).
 		NamespaceIfScoped(namespace, p.resource.Namespaced).
diff --git a/vendor/github.com/rancher/norman/types/reflection.go b/vendor/github.com/rancher/norman/types/reflection.go
index 5ecc6196..916fee99 100644
--- a/vendor/github.com/rancher/norman/types/reflection.go
+++ b/vendor/github.com/rancher/norman/types/reflection.go
@@ -153,11 +153,11 @@ func (s *Schemas) importType(version *APIVersion, t reflect.Type, overrides ...r
 	}
 
 	if s, ok := s.processingTypes[t]; ok {
-		logrus.Debugf("Returning half built schema %s for %v", typeName, t)
+		logrus.Tracef("Returning half built schema %s for %v", typeName, t)
 		return s, nil
 	}
 
-	logrus.Debugf("Inspecting schema %s for %v", typeName, t)
+	logrus.Tracef("Inspecting schema %s for %v", typeName, t)
 
 	schema, err := s.newSchemaFromType(version, t, typeName)
 	if err != nil {
@@ -274,11 +274,11 @@ func (s *Schemas) readFields(schema *Schema, t reflect.Type) error {
 		}
 
 		if blacklistNames[fieldName] {
-			logrus.Debugf("Ignoring blacklisted field %s.%s for %v", schema.ID, fieldName, field)
+			logrus.Tracef("Ignoring blacklisted field %s.%s for %v", schema.ID, fieldName, field)
 			continue
 		}
 
-		logrus.Debugf("Inspecting field %s.%s for %v", schema.ID, fieldName, field)
+		logrus.Tracef("Inspecting field %s.%s for %v", schema.ID, fieldName, field)
 
 		schemaField := Field{
 			Create:   true,
@@ -336,7 +336,7 @@ func (s *Schemas) readFields(schema *Schema, t reflect.Type) error {
 			}
 		}
 
-		logrus.Debugf("Setting field %s.%s: %#v", schema.ID, fieldName, schemaField)
+		logrus.Tracef("Setting field %s.%s: %#v", schema.ID, fieldName, schemaField)
 		schema.ResourceFields[fieldName] = schemaField
 	}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0d61d7f0..58f0cf29 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -133,7 +133,7 @@ github.com/prometheus/common/model
 github.com/prometheus/procfs
 github.com/prometheus/procfs/internal/fs
 github.com/prometheus/procfs/internal/util
-# github.com/rancher/norman v0.0.0-20200211155126-fc45a55d4dfd
+# github.com/rancher/norman v0.0.0-20200312033725-5c74e1ee1e6d
 github.com/rancher/norman/condition
 github.com/rancher/norman/controller
 github.com/rancher/norman/httperror