diff --git a/vendor.conf b/vendor.conf
index e16566eb..71074261 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -5,4 +5,4 @@ k8s.io/kubernetes                             v1.8.3
 bitbucket.org/ww/goautoneg                    a547fc61f48d567d5b4ec6f8aee5573d8efce11d https://github.com/rancher/goautoneg.git
 golang.org/x/sync                             fd80eb99c8f653c847d294a001bdf2a3a6f768f5
 
-github.com/rancher/norman                     0b548c23c75c159d4351385cec07a35281c8f5f7
+github.com/rancher/norman                     339468f1194f6da7152013577597763ff0b8cd3c
diff --git a/vendor/github.com/rancher/norman/clientbase/common.go b/vendor/github.com/rancher/norman/clientbase/common.go
index 11cd3de9..e809c327 100644
--- a/vendor/github.com/rancher/norman/clientbase/common.go
+++ b/vendor/github.com/rancher/norman/clientbase/common.go
@@ -2,6 +2,8 @@ package clientbase
 
 import (
 	"bytes"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -32,6 +34,7 @@ type ClientOpts struct {
 	SecretKey  string
 	Timeout    time.Duration
 	HTTPClient *http.Client
+	CACerts    string
 }
 
 type APIError struct {
@@ -147,6 +150,20 @@ func NewAPIClient(opts *ClientOpts) (APIBaseClient, error) {
 
 	client.Timeout = opts.Timeout
 
+	if opts.CACerts != "" {
+		roots := x509.NewCertPool()
+		ok := roots.AppendCertsFromPEM([]byte(opts.CACerts))
+		if !ok {
+			return result, err
+		}
+		tr := &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs: roots,
+			},
+		}
+		client.Transport = tr
+	}
+
 	req, err := http.NewRequest("GET", opts.URL, nil)
 	if err != nil {
 		return result, err
diff --git a/vendor/github.com/rancher/norman/condition/condition.go b/vendor/github.com/rancher/norman/condition/condition.go
index 9eb6b403..f633a7a5 100644
--- a/vendor/github.com/rancher/norman/condition/condition.go
+++ b/vendor/github.com/rancher/norman/condition/condition.go
@@ -153,12 +153,12 @@ func (c Cond) doInternal(obj runtime.Object, f func() (runtime.Object, error)) (
 
 	if err != nil {
 		if _, ok := err.(*controller.ForgetError); ok {
-			if c.IsFalse(obj) {
-				c.Unknown(obj)
+			if c.GetMessage(obj) == "" {
+				c.ReasonAndMessageFromError(obj, err)
 			}
-		} else {
-			c.False(obj)
+			return obj, err
 		}
+		c.False(obj)
 		c.ReasonAndMessageFromError(obj, err)
 		return obj, err
 	}
@@ -223,7 +223,7 @@ func findOrCreateCond(obj interface{}, condName string) reflect.Value {
 	newCond.FieldByName("Type").SetString(condName)
 	newCond.FieldByName("Status").SetString("Unknown")
 	condSlice.Set(reflect.Append(condSlice, newCond))
-	return newCond
+	return *findCond(condSlice, condName)
 }
 
 func findCond(val reflect.Value, name string) *reflect.Value {
diff --git a/vendor/github.com/rancher/norman/event/logger.go b/vendor/github.com/rancher/norman/event/logger.go
index 43d58dfa..65488315 100644
--- a/vendor/github.com/rancher/norman/event/logger.go
+++ b/vendor/github.com/rancher/norman/event/logger.go
@@ -17,19 +17,19 @@ type logger struct {
 }
 
 func (l *logger) Info(obj runtime.Object, message string) {
-	l.recorder.Event(obj, "Normal", "Message", message)
+	//l.recorder.Event(obj, "Normal", "Message", message)
 }
 
 func (l *logger) Infof(obj runtime.Object, messagefmt string, args ...interface{}) {
-	l.recorder.Eventf(obj, "Normal", "Message", messagefmt, args...)
+	//l.recorder.Eventf(obj, "Normal", "Message", messagefmt, args...)
 }
 
 func (l *logger) Error(obj runtime.Object, message string) {
-	l.recorder.Event(obj, "Warning", "Message", message)
+	//l.recorder.Event(obj, "Warning", "Message", message)
 }
 
 func (l *logger) Errorf(obj runtime.Object, messagefmt string, args ...interface{}) {
-	l.recorder.Eventf(obj, "Warning", "Message", messagefmt, args...)
+	//l.recorder.Eventf(obj, "Warning", "Message", messagefmt, args...)
 }
 
 func NewLogger(recorder record.EventRecorder) Logger {
diff --git a/vendor/github.com/rancher/norman/types/reflection.go b/vendor/github.com/rancher/norman/types/reflection.go
index d2ef7ca2..ceacfe0e 100644
--- a/vendor/github.com/rancher/norman/types/reflection.go
+++ b/vendor/github.com/rancher/norman/types/reflection.go
@@ -315,6 +315,8 @@ func applyTag(structField *reflect.StructField, field *Field) error {
 			field.Default = value
 		case "nullable":
 			field.Nullable = true
+		case "notnullable":
+			field.Nullable = false
 		case "nocreate":
 			field.Create = false
 		case "writeOnly":
diff --git a/vendor/github.com/rancher/norman/types/schema_funcs.go b/vendor/github.com/rancher/norman/types/schema_funcs.go
index 130f0e98..a6f26b9d 100644
--- a/vendor/github.com/rancher/norman/types/schema_funcs.go
+++ b/vendor/github.com/rancher/norman/types/schema_funcs.go
@@ -28,6 +28,13 @@ func (s *Schema) CanList(context *APIContext) bool {
 	return context.AccessControl.CanList(context, s)
 }
 
+func (s *Schema) CanGet(context *APIContext) bool {
+	if context == nil {
+		return slice.ContainsString(s.ResourceMethods, http.MethodGet)
+	}
+	return context.AccessControl.CanGet(context, s)
+}
+
 func (s *Schema) CanCreate(context *APIContext) bool {
 	if context == nil {
 		return slice.ContainsString(s.CollectionMethods, http.MethodPost)
diff --git a/vendor/github.com/rancher/norman/types/server_types.go b/vendor/github.com/rancher/norman/types/server_types.go
index 8b0d1ef7..14752d14 100644
--- a/vendor/github.com/rancher/norman/types/server_types.go
+++ b/vendor/github.com/rancher/norman/types/server_types.go
@@ -47,7 +47,7 @@ func (r *RawResource) MarshalJSON() ([]byte, error) {
 
 type ActionHandler func(actionName string, action *Action, request *APIContext) error
 
-type RequestHandler func(request *APIContext) error
+type RequestHandler func(request *APIContext, next RequestHandler) error
 
 type QueryFilter func(opts *QueryOptions, data []map[string]interface{}) []map[string]interface{}
 
@@ -71,6 +71,7 @@ type ResponseWriter interface {
 type AccessControl interface {
 	CanCreate(apiContext *APIContext, schema *Schema) bool
 	CanList(apiContext *APIContext, schema *Schema) bool
+	CanGet(apiContext *APIContext, schema *Schema) bool
 	CanUpdate(apiContext *APIContext, obj map[string]interface{}, schema *Schema) bool
 	CanDelete(apiContext *APIContext, obj map[string]interface{}, schema *Schema) bool
 
@@ -87,6 +88,7 @@ type APIContext struct {
 	Schema                      *Schema
 	Schemas                     *Schemas
 	Version                     *APIVersion
+	SchemasVersion              *APIVersion
 	Query                       url.Values
 	ResponseFormat              string
 	ReferenceValidator          ReferenceValidator