diff --git a/vendor.conf b/vendor.conf
index e583ceda..ac7ff1cd 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -3,5 +3,5 @@ github.com/rancher/types
 
 k8s.io/kubernetes v1.8.3 transitive=true,staging=true
 bitbucket.org/ww/goautoneg a547fc61f48d567d5b4ec6f8aee5573d8efce11d https://github.com/rancher/goautoneg.git
-github.com/rancher/norman c94e18869aa8779706235e42263aeadd754e7752
+github.com/rancher/norman 432219d44739826485fb6c9178e5db08a162a9c3
 golang.org/x/sync fd80eb99c8f653c847d294a001bdf2a3a6f768f5
diff --git a/vendor/github.com/rancher/norman/clientbase/object_client.go b/vendor/github.com/rancher/norman/clientbase/object_client.go
index bb1653a5..11ef9fcb 100644
--- a/vendor/github.com/rancher/norman/clientbase/object_client.go
+++ b/vendor/github.com/rancher/norman/clientbase/object_client.go
@@ -102,7 +102,7 @@ func (p *ObjectClient) GetNamespace(name, namespace string, opts metav1.GetOptio
 	if namespace != "" {
 		req = req.Namespace(namespace)
 	}
-	err := req.NamespaceIfScoped(p.ns, p.resource.Namespaced).
+	err := req.
 		Resource(p.resource.Name).
 		VersionedParams(&opts, dynamic.VersionedParameterEncoderWithV1Fallback).
 		Name(name).
diff --git a/vendor/github.com/rancher/norman/condition/condition.go b/vendor/github.com/rancher/norman/condition/condition.go
index 7f5d22a6..50236197 100644
--- a/vendor/github.com/rancher/norman/condition/condition.go
+++ b/vendor/github.com/rancher/norman/condition/condition.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/rancher/norman/controller"
+	err2 "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
@@ -45,7 +46,15 @@ func (c Cond) Message(obj runtime.Object, message string) {
 	getFieldValue(cond, "Message").SetString(message)
 }
 
+func (c Cond) GetMessage(obj runtime.Object) string {
+	cond := findOrCreateCond(obj, string(c))
+	return getFieldValue(cond, "Message").String()
+}
+
 func (c Cond) ReasonAndMessageFromError(obj runtime.Object, err error) {
+	if err2.IsConflict(err) {
+		return
+	}
 	cond := findOrCreateCond(obj, string(c))
 	getFieldValue(cond, "Message").SetString(err.Error())
 	if ce, ok := err.(*conditionError); ok {
@@ -87,7 +96,32 @@ func (c Cond) Once(obj runtime.Object, f func() (runtime.Object, error)) (runtim
 	return obj, nil
 }
 
+func (c Cond) DoUntilTrue(obj runtime.Object, f func() (runtime.Object, error)) (runtime.Object, error) {
+	if c.IsTrue(obj) {
+		return obj, nil
+	}
+
+	c.Unknown(obj)
+	newObj, err := f()
+	if newObj != nil {
+		obj = newObj
+	}
+
+	if err != nil {
+		c.ReasonAndMessageFromError(obj, err)
+		return obj, err
+	}
+	c.True(obj)
+	c.Reason(obj, "")
+	c.Message(obj, "")
+	return obj, nil
+}
+
 func (c Cond) Do(obj runtime.Object, f func() (runtime.Object, error)) (runtime.Object, error) {
+	return c.do(obj, f)
+}
+
+func (c Cond) do(obj runtime.Object, f func() (runtime.Object, error)) (runtime.Object, error) {
 	c.Unknown(obj)
 	newObj, err := f()
 	if newObj != nil {
diff --git a/vendor/github.com/rancher/norman/lifecycle/object.go b/vendor/github.com/rancher/norman/lifecycle/object.go
index 796409e4..2c7731c3 100644
--- a/vendor/github.com/rancher/norman/lifecycle/object.go
+++ b/vendor/github.com/rancher/norman/lifecycle/object.go
@@ -1,6 +1,8 @@
 package lifecycle
 
 import (
+	"reflect"
+
 	"github.com/rancher/norman/clientbase"
 	"github.com/rancher/norman/types/slice"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -9,7 +11,8 @@ import (
 )
 
 var (
-	created = "lifecycle.cattle.io/create"
+	created      = "lifecycle.cattle.io/create"
+	finalizerKey = "controller.cattle.io/"
 )
 
 type ObjectLifecycle interface {
@@ -52,17 +55,16 @@ func (o *objectLifecycleAdapter) sync(key string, obj runtime.Object) error {
 	}
 
 	obj = obj.DeepCopyObject()
-	if newObj, err := o.lifecycle.Updated(obj); err != nil {
-		if newObj != nil {
-			o.objectClient.Update(metadata.GetName(), newObj)
-		}
-		return err
-	} else if newObj != nil {
-		_, err = o.objectClient.Update(metadata.GetName(), newObj)
-		return err
-	}
+	newObj, err := o.lifecycle.Updated(obj)
+	o.update(metadata.GetName(), obj, newObj)
+	return err
+}
 
-	return nil
+func (o *objectLifecycleAdapter) update(name string, orig, obj runtime.Object) (runtime.Object, error) {
+	if obj != nil && !reflect.DeepEqual(orig, obj) {
+		return o.objectClient.Update(name, obj)
+	}
+	return obj, nil
 }
 
 func (o *objectLifecycleAdapter) finalize(metadata metav1.Object, obj runtime.Object) (bool, error) {
@@ -71,21 +73,19 @@ func (o *objectLifecycleAdapter) finalize(metadata metav1.Object, obj runtime.Ob
 		return true, nil
 	}
 
-	if !slice.ContainsString(metadata.GetFinalizers(), o.name) {
+	if !slice.ContainsString(metadata.GetFinalizers(), o.constructFinalizerKey()) {
 		return false, nil
 	}
 
 	obj = obj.DeepCopyObject()
 	if newObj, err := o.lifecycle.Finalize(obj); err != nil {
-		if newObj != nil {
-			o.objectClient.Update(metadata.GetName(), newObj)
-		}
+		o.update(metadata.GetName(), obj, newObj)
 		return false, err
 	} else if newObj != nil {
 		obj = newObj
 	}
 
-	if err := removeFinalizer(o.name, obj); err != nil {
+	if err := removeFinalizer(o.constructFinalizerKey(), obj); err != nil {
 		return false, err
 	}
 
@@ -115,37 +115,70 @@ func (o *objectLifecycleAdapter) createKey() string {
 	return created + "." + o.name
 }
 
-func (o *objectLifecycleAdapter) create(metadata metav1.Object, obj runtime.Object) (bool, error) {
-	initialized := o.createKey()
+func (o *objectLifecycleAdapter) constructFinalizerKey() string {
+	return finalizerKey + o.name
+}
 
-	if metadata.GetAnnotations()[initialized] == "true" {
+func (o *objectLifecycleAdapter) create(metadata metav1.Object, obj runtime.Object) (bool, error) {
+	if o.isInitialized(metadata) {
 		return true, nil
 	}
 
-	obj = obj.DeepCopyObject()
+	// addFinalizer will always return a DeepCopy
+	obj, err := o.addFinalizer(obj)
+	if err != nil {
+		return false, err
+	}
+
+	orig := obj.DeepCopyObject()
 	if newObj, err := o.lifecycle.Create(obj); err != nil {
-		if newObj != nil {
-			o.objectClient.Update(metadata.GetName(), newObj)
-		}
+		o.update(metadata.GetName(), orig, newObj)
 		return false, err
 	} else if newObj != nil {
 		obj = newObj
 	}
 
+	return false, o.setInitialized(obj)
+}
+
+func (o *objectLifecycleAdapter) isInitialized(metadata metav1.Object) bool {
+	initialized := o.createKey()
+	return metadata.GetAnnotations()[initialized] == "true"
+}
+
+func (o *objectLifecycleAdapter) setInitialized(obj runtime.Object) error {
 	metadata, err := meta.Accessor(obj)
 	if err != nil {
-		return false, err
+		return err
 	}
 
+	initialized := o.createKey()
+
 	if metadata.GetAnnotations() == nil {
 		metadata.SetAnnotations(map[string]string{})
 	}
-
-	if o.objectClient.GroupVersionKind().Kind != "Namespace" {
-		metadata.SetFinalizers(append(metadata.GetFinalizers(), o.name))
-	}
 	metadata.GetAnnotations()[initialized] = "true"
 
 	_, err = o.objectClient.Update(metadata.GetName(), obj)
-	return false, err
+	return err
+}
+
+func (o *objectLifecycleAdapter) addFinalizer(obj runtime.Object) (runtime.Object, error) {
+	obj = obj.DeepCopyObject()
+
+	metadata, err := meta.Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+
+	if o.objectClient.GroupVersionKind().Kind == "Namespace" {
+		return obj, nil
+	}
+
+	if slice.ContainsString(metadata.GetFinalizers(), o.constructFinalizerKey()) {
+		return obj, nil
+	}
+
+	metadata.SetFinalizers(append(metadata.GetFinalizers(), o.constructFinalizerKey()))
+	return o.objectClient.Update(metadata.GetName(), obj)
 }
diff --git a/vendor/github.com/rancher/norman/types/convert/convert.go b/vendor/github.com/rancher/norman/types/convert/convert.go
index 43ba4774..a2a6c49a 100644
--- a/vendor/github.com/rancher/norman/types/convert/convert.go
+++ b/vendor/github.com/rancher/norman/types/convert/convert.go
@@ -104,7 +104,16 @@ func LowerTitle(input string) string {
 }
 
 func IsEmpty(v interface{}) bool {
-	return v == nil || v == "" || v == 0 || v == false
+	if v == nil || v == "" || v == 0 || v == false {
+		return true
+	}
+	if m, ok := v.(map[string]interface{}); ok {
+		return len(m) == 0
+	}
+	if s, ok := v.([]interface{}); ok {
+		return len(s) == 0
+	}
+	return false
 }
 
 func ToMapInterface(obj interface{}) map[string]interface{} {
@@ -112,6 +121,13 @@ func ToMapInterface(obj interface{}) map[string]interface{} {
 	return v
 }
 
+func ToInterfaceSlice(obj interface{}) []interface{} {
+	if v, ok := obj.([]interface{}); ok {
+		return v
+	}
+	return nil
+}
+
 func ToMapSlice(obj interface{}) []map[string]interface{} {
 	if v, ok := obj.([]map[string]interface{}); ok {
 		return v
diff --git a/vendor/github.com/rancher/norman/types/mapper/drop.go b/vendor/github.com/rancher/norman/types/mapper/drop.go
index 64032d8f..40d22a3a 100644
--- a/vendor/github.com/rancher/norman/types/mapper/drop.go
+++ b/vendor/github.com/rancher/norman/types/mapper/drop.go
@@ -7,7 +7,8 @@ import (
 )
 
 type Drop struct {
-	Field string
+	Field            string
+	IgnoreDefinition bool
 }
 
 func (d Drop) FromInternal(data map[string]interface{}) {
@@ -19,7 +20,9 @@ func (d Drop) ToInternal(data map[string]interface{}) {
 
 func (d Drop) ModifySchema(schema *types.Schema, schemas *types.Schemas) error {
 	if _, ok := schema.ResourceFields[d.Field]; !ok {
-		return fmt.Errorf("can not drop missing field %s on %s", d.Field, schema.ID)
+		if !d.IgnoreDefinition {
+			return fmt.Errorf("can not drop missing field %s on %s", d.Field, schema.ID)
+		}
 	}
 
 	delete(schema.ResourceFields, d.Field)
diff --git a/vendor/github.com/rancher/norman/types/mapper/metadata.go b/vendor/github.com/rancher/norman/types/mapper/metadata.go
index 47b31338..6cdf9aa3 100644
--- a/vendor/github.com/rancher/norman/types/mapper/metadata.go
+++ b/vendor/github.com/rancher/norman/types/mapper/metadata.go
@@ -7,19 +7,19 @@ import (
 func NewMetadataMapper() types.Mapper {
 	return types.Mappers{
 		ChangeType{Field: "name", Type: "dnsLabel"},
-		Drop{"generateName"},
+		Drop{Field: "generateName"},
 		//Move{From: "selfLink", To: "resourcePath"},
-		Drop{"selfLink"},
+		Drop{Field: "selfLink"},
 		//Drop{"ownerReferences"},
 		Move{From: "uid", To: "uuid"},
-		Drop{"resourceVersion"},
-		Drop{"generation"},
+		Drop{Field: "resourceVersion"},
+		Drop{Field: "generation"},
 		Move{From: "creationTimestamp", To: "created"},
 		Move{From: "deletionTimestamp", To: "removed"},
-		Drop{"deletionGracePeriodSeconds"},
-		Drop{"initializers"},
+		Drop{Field: "deletionGracePeriodSeconds"},
+		Drop{Field: "initializers"},
 		//Drop{"finalizers"},
-		Drop{"clusterName"},
+		Drop{Field: "clusterName"},
 		ReadOnly{Field: "*"},
 		Access{
 			Fields: map[string]string{
diff --git a/vendor/github.com/rancher/norman/types/mapper/object.go b/vendor/github.com/rancher/norman/types/mapper/object.go
index ec12297e..3d752e66 100644
--- a/vendor/github.com/rancher/norman/types/mapper/object.go
+++ b/vendor/github.com/rancher/norman/types/mapper/object.go
@@ -14,14 +14,15 @@ func NewObject(mappers ...types.Mapper) Object {
 			&Embed{Field: "metadata"},
 			&Embed{Field: "spec", Optional: true},
 			&ReadOnly{Field: "status", Optional: true, SubFields: true},
-			Drop{"kind"},
-			Drop{"apiVersion"},
+			Drop{Field: "kind"},
+			Drop{Field: "apiVersion"},
 			&Scope{
 				IfNot: types.NamespaceScope,
 				Mappers: []types.Mapper{
-					&Drop{"namespace"},
+					&Drop{Field: "namespace"},
 				},
 			},
+			Drop{Field: "finalizers", IgnoreDefinition: true},
 		}, mappers...),
 	}
 }
diff --git a/vendor/github.com/rancher/norman/types/mapper/slice_merge.go b/vendor/github.com/rancher/norman/types/mapper/slice_merge.go
new file mode 100644
index 00000000..b4a23990
--- /dev/null
+++ b/vendor/github.com/rancher/norman/types/mapper/slice_merge.go
@@ -0,0 +1,47 @@
+package mapper
+
+import (
+	"github.com/rancher/norman/types"
+	"github.com/rancher/norman/types/convert"
+)
+
+type SliceMerge struct {
+	From             []string
+	To               string
+	IgnoreDefinition bool
+}
+
+func (s SliceMerge) FromInternal(data map[string]interface{}) {
+	var result []interface{}
+	for _, name := range s.From {
+		val, ok := data[name]
+		if !ok {
+			continue
+		}
+		result = append(result, convert.ToInterfaceSlice(val)...)
+	}
+
+	if result != nil {
+		data[s.To] = result
+	}
+}
+
+func (s SliceMerge) ToInternal(data map[string]interface{}) {
+}
+
+func (s SliceMerge) ModifySchema(schema *types.Schema, schemas *types.Schemas) error {
+	if s.IgnoreDefinition {
+		return nil
+	}
+
+	for _, from := range s.From {
+		if err := ValidateField(from, schema); err != nil {
+			return err
+		}
+		if from != s.To {
+			delete(schema.ResourceFields, from)
+		}
+	}
+
+	return ValidateField(s.To, schema)
+}