diff --git a/api/inspect/inspect.proto b/api/inspect/inspect.proto
index 821ebd124..6fa387a59 100644
--- a/api/inspect/inspect.proto
+++ b/api/inspect/inspect.proto
@@ -26,9 +26,10 @@ message ControllerRuntimeDependency {
 message ControllerRuntimeDependenciesResponse { repeated ControllerRuntimeDependency messages = 1; }
 
 enum DependencyEdgeType {
-    MANAGES = 0;
-    STRONG = 1;
-    WEAK = 2;
+    OUTPUT_EXCLUSIVE = 0;
+    OUTPUT_SHARED = 3;
+    INPUT_STRONG = 1;
+    INPUT_WEAK = 2;
 }
 
 message ControllerDependencyEdge {
diff --git a/api/resource/resource.proto b/api/resource/resource.proto
index 4a2fb71b9..14b374d56 100644
--- a/api/resource/resource.proto
+++ b/api/resource/resource.proto
@@ -30,6 +30,7 @@ message Metadata {
     string type = 2;
     string id = 3;
     string version = 4;
+    string owner = 7;
     string phase = 5;
     repeated string finalizers = 6;
 }
diff --git a/cmd/talosctl/cmd/talos/inspect.go b/cmd/talosctl/cmd/talos/inspect.go
index 1c9e3c736..fdd6c30f8 100644
--- a/cmd/talosctl/cmd/talos/inspect.go
+++ b/cmd/talosctl/cmd/talos/inspect.go
@@ -63,11 +63,11 @@ to render the graph:
 			graph := dot.NewGraph(dot.Directed)
 
 			resourceTypeID := func(edge *inspect.ControllerDependencyEdge) string {
-				return fmt.Sprintf("%s:%s", edge.GetResourceNamespace(), edge.GetResourceType())
+				return edge.GetResourceType()
 			}
 
 			resourceID := func(r resource.Resource) string {
-				return r.Metadata().ID()
+				return fmt.Sprintf("%s/%s/%s", r.Metadata().Namespace(), r.Metadata().Type(), r.Metadata().ID())
 			}
 
 			if inspectDependenciesCmdFlags.withResources {
@@ -127,12 +127,20 @@ to render the graph:
 								continue
 							}
 
+							if (edge.GetEdgeType() == inspect.DependencyEdgeType_OUTPUT_EXCLUSIVE ||
+								edge.GetEdgeType() == inspect.DependencyEdgeType_OUTPUT_SHARED) &&
+								edge.GetControllerName() != resource.Metadata().Owner() {
+								continue
+							}
+
 							switch edge.GetEdgeType() {
-							case inspect.DependencyEdgeType_MANAGES:
+							case inspect.DependencyEdgeType_OUTPUT_EXCLUSIVE:
 								graph.Edge(graph.Node(edge.ControllerName), graph.Subgraph(resourceTypeID(edge)).Node(resourceID(resource))).Solid()
-							case inspect.DependencyEdgeType_STRONG:
+							case inspect.DependencyEdgeType_OUTPUT_SHARED:
+								graph.Edge(graph.Node(edge.ControllerName), graph.Subgraph(resourceTypeID(edge)).Node(resourceID(resource))).Solid()
+							case inspect.DependencyEdgeType_INPUT_STRONG:
 								graph.Edge(graph.Subgraph(resourceTypeID(edge)).Node(resourceID(resource)), graph.Node(edge.ControllerName)).Solid()
-							case inspect.DependencyEdgeType_WEAK:
+							case inspect.DependencyEdgeType_INPUT_WEAK:
 								graph.Edge(graph.Subgraph(resourceTypeID(edge)).Node(resourceID(resource)), graph.Node(edge.ControllerName)).Dotted()
 							}
 						}
@@ -159,11 +167,13 @@ to render the graph:
 						}
 
 						switch edge.GetEdgeType() {
-						case inspect.DependencyEdgeType_MANAGES:
+						case inspect.DependencyEdgeType_OUTPUT_EXCLUSIVE:
 							graph.Edge(graph.Node(edge.ControllerName), graph.Node(resourceTypeID(edge))).Bold()
-						case inspect.DependencyEdgeType_STRONG:
+						case inspect.DependencyEdgeType_OUTPUT_SHARED:
+							graph.Edge(graph.Node(edge.ControllerName), graph.Node(resourceTypeID(edge))).Solid()
+						case inspect.DependencyEdgeType_INPUT_STRONG:
 							graph.Edge(graph.Node(resourceTypeID(edge)), graph.Node(edge.ControllerName), idLabels...).Solid()
-						case inspect.DependencyEdgeType_WEAK:
+						case inspect.DependencyEdgeType_INPUT_WEAK:
 							graph.Edge(graph.Node(resourceTypeID(edge)), graph.Node(edge.ControllerName), idLabels...).Dotted()
 						}
 					}
diff --git a/go.mod b/go.mod
index a215bcb21..ddc9c5761 100644
--- a/go.mod
+++ b/go.mod
@@ -74,7 +74,7 @@ require (
 	github.com/talos-systems/go-smbios v0.0.0-20201228201610-fb425d4727e6
 	github.com/talos-systems/grpc-proxy v0.2.0
 	github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa
-	github.com/talos-systems/os-runtime v0.0.0-20210315190223-7b3d14457439
+	github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4
 	github.com/talos-systems/talos/pkg/machinery v0.0.0-20210302191918-8ffb55943c71
 	github.com/u-root/u-root v7.0.0+incompatible
 	github.com/vmware-tanzu/sonobuoy v0.20.0
diff --git a/go.sum b/go.sum
index c9ce7f4a1..6d04dc0b4 100644
--- a/go.sum
+++ b/go.sum
@@ -577,8 +577,8 @@ github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjh
 github.com/hashicorp/go-immutable-radix v1.2.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.0 h1:8exGP7ego3OmkfksihtSouGMZ+hQrhxx+FVELeXpVPE=
 github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-memdb v1.3.0 h1:xdXq34gBOMEloa9rlGStLxmfX/dyIK8htOv36dQUwHU=
-github.com/hashicorp/go-memdb v1.3.0/go.mod h1:Mluclgwib3R93Hk5fxEfiRhB+6Dar64wWh71LpNSe3g=
+github.com/hashicorp/go-memdb v1.3.2 h1:RBKHOsnSszpU6vxq80LzC2BaQjuuvoyaQbkLTf7V7g8=
+github.com/hashicorp/go-memdb v1.3.2/go.mod h1:Mluclgwib3R93Hk5fxEfiRhB+6Dar64wWh71LpNSe3g=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v1.1.5/go.mod h1:gWVc3sv/wbDmR3rQsj1CAktEZzoz1YNK9NfGLXJ69/4=
@@ -1003,7 +1003,6 @@ github.com/talos-systems/go-procfs v0.0.0-20210108152626-8cbc42d3dc24 h1:fN8vYvl
 github.com/talos-systems/go-procfs v0.0.0-20210108152626-8cbc42d3dc24/go.mod h1:ATyUGFQIW8OnbnmvqefZWVPgL9g+CAmXHfkgny21xX8=
 github.com/talos-systems/go-retry v0.1.0/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
 github.com/talos-systems/go-retry v0.1.1-0.20201113203059-8c63d290a688/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
-github.com/talos-systems/go-retry v0.2.0/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
 github.com/talos-systems/go-retry v0.2.1-0.20210119124456-b9dc1a990133 h1:mHnKEViee9x2A6YbsUykwqh7L+tLpm5HTlos2QDlqts=
 github.com/talos-systems/go-retry v0.2.1-0.20210119124456-b9dc1a990133/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
 github.com/talos-systems/go-smbios v0.0.0-20201228201610-fb425d4727e6 h1:xyE29iB9cVeFZs7WS2RG57MikJt8q6hIQvQajMWiloM=
@@ -1012,9 +1011,8 @@ github.com/talos-systems/grpc-proxy v0.2.0 h1:DN75bLfaW4xfhq0r0mwFRnfGhSB+HPhK1L
 github.com/talos-systems/grpc-proxy v0.2.0/go.mod h1:sm97Vc/z2cok3pu6ruNeszQej4KDxFrDgfWs4C1mtC4=
 github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa h1:XqOMTt0Q6mjsk8Dea5wUpgcdtf+AzesH11m4AozWSxw=
 github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa/go.mod h1:VreSAyRmxMtqussAHSKMKkJQa1YwBTSVfkmE4Jydam4=
-github.com/talos-systems/os-runtime v0.0.0-20210303124137-84c3c875eb2b/go.mod h1:Z+1phKVJ0IWH+Jd2DGufL8WKqxd3xt1xlcsxcU18ZL0=
-github.com/talos-systems/os-runtime v0.0.0-20210315190223-7b3d14457439 h1:3Q7eMWbwg1pndsvOo/VV8mgQKweDDvPczLZu7LAS9+o=
-github.com/talos-systems/os-runtime v0.0.0-20210315190223-7b3d14457439/go.mod h1:B2hrj55wAJ3RJxConurFKlFGhm7mkF3zWw5DBQw8LvA=
+github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4 h1:mVlqonAE7QgFWn1g9p2b+EBC4Lk57TexASvp7tHglRc=
+github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4/go.mod h1:358qvRxAR16NdF8fiitixPgECx4Pj32yXLHAWYWZc/g=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_inspect.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_inspect.go
index 7c9303b8d..7ecd36892 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_inspect.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_inspect.go
@@ -34,12 +34,14 @@ func (s *InspectServer) ControllerRuntimeDependencies(ctx context.Context, in *e
 		var edgeType inspectapi.DependencyEdgeType
 
 		switch graph.Edges[i].EdgeType {
-		case controller.EdgeManages:
-			edgeType = inspectapi.DependencyEdgeType_MANAGES
-		case controller.EdgeDependsStrong:
-			edgeType = inspectapi.DependencyEdgeType_STRONG
-		case controller.EdgeDependsWeak:
-			edgeType = inspectapi.DependencyEdgeType_WEAK
+		case controller.EdgeOutputExclusive:
+			edgeType = inspectapi.DependencyEdgeType_OUTPUT_EXCLUSIVE
+		case controller.EdgeOutputShared:
+			edgeType = inspectapi.DependencyEdgeType_OUTPUT_SHARED
+		case controller.EdgeInputStrong:
+			edgeType = inspectapi.DependencyEdgeType_INPUT_STRONG
+		case controller.EdgeInputWeak:
+			edgeType = inspectapi.DependencyEdgeType_INPUT_WEAK
 		}
 
 		edges = append(edges, &inspectapi.ControllerDependencyEdge{
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
index 2846a8848..e330fa3b4 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
@@ -33,6 +33,7 @@ func marshalResource(r resource.Resource) (*resourceapi.Resource, error) {
 		Id:        r.Metadata().ID(),
 		Version:   r.Metadata().Version().String(),
 		Phase:     r.Metadata().Phase().String(),
+		Owner:     r.Metadata().Owner(),
 	}
 
 	for _, fin := range *r.Metadata().Finalizers() {
diff --git a/internal/app/machined/pkg/controllers/config/k8s_control_plane.go b/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
index f715a35a2..c30bb95b3 100644
--- a/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
+++ b/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
@@ -31,32 +31,38 @@ func (ctrl *K8sControlPlaneController) Name() string {
 	return "config.K8sControlPlaneController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *K8sControlPlaneController) ManagedResources() (resource.Namespace, resource.Type) {
-	return config.NamespaceName, config.K8sControlPlaneType
+// Inputs implements controller.Controller interface.
+func (ctrl *K8sControlPlaneController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineConfigType,
+			ID:        pointer.ToString(config.V1Alpha1ID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineTypeType,
+			ID:        pointer.ToString(config.MachineTypeID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *K8sControlPlaneController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: config.K8sControlPlaneType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *K8sControlPlaneController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.MachineConfigType,
-			ID:        pointer.ToString(config.V1Alpha1ID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.MachineTypeType,
-			ID:        pointer.ToString(config.MachineTypeID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -133,7 +139,7 @@ func (ctrl *K8sControlPlaneController) manageAPIServerConfig(ctx context.Context
 		cloudProvider = "external"
 	}
 
-	return r.Update(ctx, config.NewK8sControlPlaneAPIServer(), func(r resource.Resource) error {
+	return r.Modify(ctx, config.NewK8sControlPlaneAPIServer(), func(r resource.Resource) error {
 		r.(*config.K8sControlPlane).SetAPIServer(config.K8sControlPlaneAPIServerSpec{
 			Image:                cfgProvider.Cluster().APIServer().Image(),
 			CloudProvider:        cloudProvider,
@@ -155,7 +161,7 @@ func (ctrl *K8sControlPlaneController) manageControllerManagerConfig(ctx context
 		cloudProvider = "external"
 	}
 
-	return r.Update(ctx, config.NewK8sControlPlaneControllerManager(), func(r resource.Resource) error {
+	return r.Modify(ctx, config.NewK8sControlPlaneControllerManager(), func(r resource.Resource) error {
 		r.(*config.K8sControlPlane).SetControllerManager(config.K8sControlPlaneControllerManagerSpec{
 			Image:         cfgProvider.Cluster().ControllerManager().Image(),
 			CloudProvider: cloudProvider,
@@ -170,7 +176,7 @@ func (ctrl *K8sControlPlaneController) manageControllerManagerConfig(ctx context
 }
 
 func (ctrl *K8sControlPlaneController) manageSchedulerConfig(ctx context.Context, r controller.Runtime, logger *log.Logger, cfgProvider talosconfig.Provider) error {
-	return r.Update(ctx, config.NewK8sControlPlaneScheduler(), func(r resource.Resource) error {
+	return r.Modify(ctx, config.NewK8sControlPlaneScheduler(), func(r resource.Resource) error {
 		r.(*config.K8sControlPlane).SetScheduler(config.K8sControlPlaneSchedulerSpec{
 			Image:        cfgProvider.Cluster().Scheduler().Image(),
 			ExtraArgs:    cfgProvider.Cluster().Scheduler().ExtraArgs(),
@@ -204,7 +210,7 @@ func (ctrl *K8sControlPlaneController) manageManifestsConfig(ctx context.Context
 		}
 	}
 
-	return r.Update(ctx, config.NewK8sManifests(), func(r resource.Resource) error {
+	return r.Modify(ctx, config.NewK8sManifests(), func(r resource.Resource) error {
 		images := images.List(cfgProvider)
 
 		r.(*config.K8sControlPlane).SetManifests(config.K8sManifestsSpec{
@@ -234,7 +240,7 @@ func (ctrl *K8sControlPlaneController) manageManifestsConfig(ctx context.Context
 }
 
 func (ctrl *K8sControlPlaneController) manageExtraManifestsConfig(ctx context.Context, r controller.Runtime, logger *log.Logger, cfgProvider talosconfig.Provider) error {
-	return r.Update(ctx, config.NewK8sExtraManifests(), func(r resource.Resource) error {
+	return r.Modify(ctx, config.NewK8sExtraManifests(), func(r resource.Resource) error {
 		spec := config.K8sExtraManifestsSpec{}
 
 		if cfgProvider.Cluster().Network().CNI().Name() == constants.CustomCNI {
diff --git a/internal/app/machined/pkg/controllers/config/k8s_control_plane_test.go b/internal/app/machined/pkg/controllers/config/k8s_control_plane_test.go
index 63800b4b5..c71ab283d 100644
--- a/internal/app/machined/pkg/controllers/config/k8s_control_plane_test.go
+++ b/internal/app/machined/pkg/controllers/config/k8s_control_plane_test.go
@@ -234,7 +234,7 @@ func (suite *K8sControlPlaneSuite) TearDownTest() {
 
 	// trigger updates in resources to stop watch loops
 	suite.Assert().NoError(suite.state.Create(context.Background(), k8s.NewSecretsStatus(k8s.ControlPlaneNamespaceName, "-")))
-	suite.Assert().NoError(suite.state.Destroy(context.Background(), config.NewK8sControlPlaneAPIServer().Metadata()))
+	suite.Assert().NoError(suite.state.Destroy(context.Background(), config.NewK8sControlPlaneAPIServer().Metadata(), state.WithDestroyOwner("config.K8sControlPlaneController")))
 }
 
 func TestK8sControlPlaneSuite(t *testing.T) {
diff --git a/internal/app/machined/pkg/controllers/config/machine_type.go b/internal/app/machined/pkg/controllers/config/machine_type.go
index 4323f778e..0ba4ec27d 100644
--- a/internal/app/machined/pkg/controllers/config/machine_type.go
+++ b/internal/app/machined/pkg/controllers/config/machine_type.go
@@ -26,24 +26,30 @@ func (ctrl *MachineTypeController) Name() string {
 	return "config.MachineTypeController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *MachineTypeController) ManagedResources() (resource.Namespace, resource.Type) {
-	return config.NamespaceName, config.MachineTypeType
-}
-
-// Run implements controller.Controller interface.
-func (ctrl *MachineTypeController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineTypeController) Inputs() []controller.Input {
+	return []controller.Input{
 		{
 			Namespace: config.NamespaceName,
 			Type:      config.MachineConfigType,
 			ID:        pointer.ToString(config.V1Alpha1ID),
-			Kind:      controller.DependencyWeak,
+			Kind:      controller.InputWeak,
 		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
 	}
+}
 
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineTypeController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: config.MachineTypeType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *MachineTypeController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	for {
 		select {
 		case <-ctx.Done():
@@ -62,7 +68,7 @@ func (ctrl *MachineTypeController) Run(ctx context.Context, r controller.Runtime
 			machineType = cfg.(*config.MachineConfig).Config().Machine().Type()
 		}
 
-		if err = r.Update(ctx, config.NewMachineType(), func(r resource.Resource) error {
+		if err = r.Modify(ctx, config.NewMachineType(), func(r resource.Resource) error {
 			r.(*config.MachineType).SetMachineType(machineType)
 
 			return nil
diff --git a/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod.go b/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod.go
index e603c9a77..5c8708bbe 100644
--- a/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod.go
+++ b/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod.go
@@ -32,31 +32,37 @@ func (ctrl *ControlPlaneStaticPodController) Name() string {
 	return "k8s.ControlPlaneStaticPodController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *ControlPlaneStaticPodController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ControlPlaneNamespaceName, k8s.StaticPodType
+// Inputs implements controller.Controller interface.
+func (ctrl *ControlPlaneStaticPodController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.K8sControlPlaneType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: k8s.ControlPlaneNamespaceName,
+			Type:      k8s.SecretsStatusType,
+			ID:        pointer.ToString(k8s.StaticPodSecretsStaticPodID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ControlPlaneStaticPodController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.StaticPodType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *ControlPlaneStaticPodController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.K8sControlPlaneType,
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: k8s.ControlPlaneNamespaceName,
-			Type:      k8s.SecretsStatusType,
-			ID:        pointer.ToString(k8s.StaticPodSecretsStaticPodID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -214,7 +220,7 @@ func (ctrl *ControlPlaneStaticPodController) manageAPIServer(ctx context.Context
 		args = append(args, fmt.Sprintf("--%s=%s", k, v))
 	}
 
-	return r.Update(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-apiserver", nil), func(r resource.Resource) error {
+	return r.Modify(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-apiserver", nil), func(r resource.Resource) error {
 		r.(*k8s.StaticPod).SetPod(&v1.Pod{
 			TypeMeta: metav1.TypeMeta{
 				APIVersion: "v1",
@@ -308,7 +314,7 @@ func (ctrl *ControlPlaneStaticPodController) manageControllerManager(ctx context
 	}
 
 	//nolint:dupl
-	return r.Update(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-controller-manager", nil), func(r resource.Resource) error {
+	return r.Modify(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-controller-manager", nil), func(r resource.Resource) error {
 		r.(*k8s.StaticPod).SetPod(&v1.Pod{
 			TypeMeta: metav1.TypeMeta{
 				APIVersion: "v1",
@@ -390,7 +396,7 @@ func (ctrl *ControlPlaneStaticPodController) manageScheduler(ctx context.Context
 	}
 
 	//nolint:dupl
-	return r.Update(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-scheduler", nil), func(r resource.Resource) error {
+	return r.Modify(ctx, k8s.NewStaticPod(k8s.ControlPlaneNamespaceName, "kube-scheduler", nil), func(r resource.Resource) error {
 		r.(*k8s.StaticPod).SetPod(&v1.Pod{
 			TypeMeta: metav1.TypeMeta{
 				APIVersion: "v1",
diff --git a/internal/app/machined/pkg/controllers/k8s/extra_manifest.go b/internal/app/machined/pkg/controllers/k8s/extra_manifest.go
index cce7c3f5d..6f4e6e46b 100644
--- a/internal/app/machined/pkg/controllers/k8s/extra_manifest.go
+++ b/internal/app/machined/pkg/controllers/k8s/extra_manifest.go
@@ -33,32 +33,38 @@ func (ctrl *ExtraManifestController) Name() string {
 	return "k8s.ExtraManifestController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *ExtraManifestController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ExtraNamespaceName, k8s.ManifestType
+// Inputs implements controller.Controller interface.
+func (ctrl *ExtraManifestController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.K8sControlPlaneType,
+			ID:        pointer.ToString(config.K8sExtraManifestsID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.ServiceType,
+			ID:        pointer.ToString("networkd"),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ExtraManifestController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.ManifestType,
+			Kind: controller.OutputShared,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *ExtraManifestController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.K8sControlPlaneType,
-			ID:        pointer.ToString(config.K8sExtraManifestsID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.ServiceType,
-			ID:        pointer.ToString("networkd"),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -114,12 +120,16 @@ func (ctrl *ExtraManifestController) Run(ctx context.Context, r controller.Runti
 			return multiErr.ErrorOrNil()
 		}
 
-		allManifests, err := r.List(ctx, resource.NewMetadata(k8s.ExtraNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
+		allManifests, err := r.List(ctx, resource.NewMetadata(k8s.ControlPlaneNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
 		if err != nil {
 			return fmt.Errorf("error listing extra manifests: %w", err)
 		}
 
 		for _, manifest := range allManifests.Items {
+			if manifest.Metadata().Owner() != ctrl.Name() {
+				continue
+			}
+
 			if _, exists := presentManifests[manifest.Metadata().ID()]; !exists {
 				if err = r.Destroy(ctx, manifest.Metadata()); err != nil {
 					return fmt.Errorf("error cleaning up extra manifest: %w", err)
@@ -185,7 +195,7 @@ func (ctrl *ExtraManifestController) download(ctx context.Context, r controller.
 		return
 	}
 
-	if err = r.Update(ctx, k8s.NewManifest(k8s.ExtraNamespaceName, id),
+	if err = r.Modify(ctx, k8s.NewManifest(k8s.ControlPlaneNamespaceName, id),
 		func(r resource.Resource) error {
 			return r.(*k8s.Manifest).SetYAML(contents)
 		}); err != nil {
@@ -197,13 +207,18 @@ func (ctrl *ExtraManifestController) download(ctx context.Context, r controller.
 	return id, nil
 }
 
+//nolint: dupl
 func (ctrl *ExtraManifestController) teardownAll(ctx context.Context, r controller.Runtime) error {
-	manifests, err := r.List(ctx, resource.NewMetadata(k8s.ExtraNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
+	manifests, err := r.List(ctx, resource.NewMetadata(k8s.ControlPlaneNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
 	if err != nil {
 		return fmt.Errorf("error listing extra manifests: %w", err)
 	}
 
 	for _, manifest := range manifests.Items {
+		if manifest.Metadata().Owner() != ctrl.Name() {
+			continue
+		}
+
 		if err = r.Destroy(ctx, manifest.Metadata()); err != nil {
 			return fmt.Errorf("error destroying extra manifest: %w", err)
 		}
diff --git a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
index a0f351d1b..2c94cde8d 100644
--- a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
+++ b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
@@ -36,49 +36,55 @@ func (ctrl *KubeletStaticPodController) Name() string {
 	return "k8s.KubeletStaticPodController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *KubeletStaticPodController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ControlPlaneNamespaceName, k8s.StaticPodStatusType
+// Inputs implements controller.Controller interface.
+func (ctrl *KubeletStaticPodController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: k8s.ControlPlaneNamespaceName,
+			Type:      k8s.StaticPodType,
+			Kind:      controller.InputStrong,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.ServiceType,
+			ID:        pointer.ToString("kubelet"),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.KubernetesType,
+			ID:        pointer.ToString(secrets.KubernetesID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.RootType,
+			ID:        pointer.ToString(secrets.RootKubernetesID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.BootstrapStatusType,
+			ID:        pointer.ToString(v1alpha1.BootstrapStatusID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *KubeletStaticPodController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.StaticPodStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo,cyclop
 func (ctrl *KubeletStaticPodController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: k8s.ControlPlaneNamespaceName,
-			Type:      k8s.StaticPodType,
-			Kind:      controller.DependencyStrong,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.ServiceType,
-			ID:        pointer.ToString("kubelet"),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.KubernetesType,
-			ID:        pointer.ToString(secrets.KubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.RootType,
-			ID:        pointer.ToString(secrets.RootKubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.BootstrapStatusType,
-			ID:        pointer.ToString(v1alpha1.BootstrapStatusID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	var kubeletClient *kubelet.Client
 
 	refreshTicker := time.NewTicker(15 * time.Second) // refresh kubelet pods status every 15 seconds
@@ -339,7 +345,7 @@ func (ctrl *KubeletStaticPodController) refreshPodStatus(ctx context.Context, r
 
 		podsSeen[statusID] = struct{}{}
 
-		if err = r.Update(ctx, k8s.NewStaticPodStatus(k8s.ControlPlaneNamespaceName, statusID), func(r resource.Resource) error {
+		if err = r.Modify(ctx, k8s.NewStaticPodStatus(k8s.ControlPlaneNamespaceName, statusID), func(r resource.Resource) error {
 			r.(*k8s.StaticPodStatus).SetStatus(&pod.Status)
 
 			return nil
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest.go b/internal/app/machined/pkg/controllers/k8s/manifest.go
index 725516a95..16b72a964 100644
--- a/internal/app/machined/pkg/controllers/k8s/manifest.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest.go
@@ -30,32 +30,38 @@ func (ctrl *ManifestController) Name() string {
 	return "k8s.ManifestController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *ManifestController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ControlPlaneNamespaceName, k8s.ManifestType
+// Inputs implements controller.Controller interface.
+func (ctrl *ManifestController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.K8sControlPlaneType,
+			ID:        pointer.ToString(config.K8sManifestsID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.RootType,
+			ID:        pointer.ToString(secrets.RootKubernetesID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ManifestController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.ManifestType,
+			Kind: controller.OutputShared,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *ManifestController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.K8sControlPlaneType,
-			ID:        pointer.ToString(config.K8sManifestsID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.RootType,
-			ID:        pointer.ToString(secrets.RootKubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -101,7 +107,7 @@ func (ctrl *ManifestController) Run(ctx context.Context, r controller.Runtime, l
 		for _, renderedManifest := range renderedManifests {
 			renderedManifest := renderedManifest
 
-			if err = r.Update(ctx, k8s.NewManifest(k8s.ControlPlaneNamespaceName, renderedManifest.name),
+			if err = r.Modify(ctx, k8s.NewManifest(k8s.ControlPlaneNamespaceName, renderedManifest.name),
 				func(r resource.Resource) error {
 					return r.(*k8s.Manifest).SetYAML(renderedManifest.data)
 				}); err != nil {
@@ -118,6 +124,10 @@ func (ctrl *ManifestController) Run(ctx context.Context, r controller.Runtime, l
 		manifestsToDelete := map[string]struct{}{}
 
 		for _, manifest := range manifests.Items {
+			if manifest.Metadata().Owner() != ctrl.Name() {
+				continue
+			}
+
 			manifestsToDelete[manifest.Metadata().ID()] = struct{}{}
 		}
 
@@ -220,6 +230,7 @@ func (ctrl *ManifestController) render(cfg config.K8sManifestsSpec, scrt *secret
 	return manifests, nil
 }
 
+//nolint: dupl
 func (ctrl *ManifestController) teardownAll(ctx context.Context, r controller.Runtime) error {
 	manifests, err := r.List(ctx, resource.NewMetadata(k8s.ControlPlaneNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
 	if err != nil {
@@ -227,6 +238,10 @@ func (ctrl *ManifestController) teardownAll(ctx context.Context, r controller.Ru
 	}
 
 	for _, manifest := range manifests.Items {
+		if manifest.Metadata().Owner() != ctrl.Name() {
+			continue
+		}
+
 		if err = r.Destroy(ctx, manifest.Metadata()); err != nil {
 			return fmt.Errorf("error destroying manifest: %w", err)
 		}
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest_apply.go b/internal/app/machined/pkg/controllers/k8s/manifest_apply.go
index 687e02312..f7fbb6b9f 100644
--- a/internal/app/machined/pkg/controllers/k8s/manifest_apply.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest_apply.go
@@ -43,42 +43,43 @@ func (ctrl *ManifestApplyController) Name() string {
 	return "k8s.ManifestApplyController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *ManifestApplyController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ControlPlaneNamespaceName, k8s.ManifestStatusType
+// Inputs implements controller.Controller interface.
+func (ctrl *ManifestApplyController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.KubernetesType,
+			ID:        pointer.ToString(secrets.KubernetesID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: k8s.ControlPlaneNamespaceName,
+			Type:      k8s.ManifestType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.BootstrapStatusType,
+			ID:        pointer.ToString(v1alpha1.BootstrapStatusID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ManifestApplyController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.ManifestStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *ManifestApplyController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.KubernetesType,
-			ID:        pointer.ToString(secrets.KubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: k8s.ControlPlaneNamespaceName,
-			Type:      k8s.ManifestType,
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: k8s.ExtraNamespaceName,
-			Type:      k8s.ManifestType,
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.BootstrapStatusType,
-			ID:        pointer.ToString(v1alpha1.BootstrapStatusID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -117,13 +118,6 @@ func (ctrl *ManifestApplyController) Run(ctx context.Context, r controller.Runti
 			return fmt.Errorf("error listing manifests: %w", err)
 		}
 
-		extraManifests, err := r.List(ctx, resource.NewMetadata(k8s.ExtraNamespaceName, k8s.ManifestType, "", resource.VersionUndefined))
-		if err != nil {
-			return fmt.Errorf("error listing extra manifests: %w", err)
-		}
-
-		manifests.Items = append(manifests.Items, extraManifests.Items...)
-
 		sort.Slice(manifests.Items, func(i, j int) bool {
 			return manifests.Items[i].Metadata().ID() < manifests.Items[j].Metadata().ID()
 		})
@@ -165,7 +159,7 @@ func (ctrl *ManifestApplyController) Run(ctx context.Context, r controller.Runti
 			}
 		}
 
-		if err = r.Update(ctx, k8s.NewManifestStatus(k8s.ControlPlaneNamespaceName), func(r resource.Resource) error {
+		if err = r.Modify(ctx, k8s.NewManifestStatus(k8s.ControlPlaneNamespaceName), func(r resource.Resource) error {
 			status := r.(*k8s.ManifestStatus).Status()
 
 			status.ManifestsApplied = make([]string, 0, len(manifests.Items))
diff --git a/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go b/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
index 87364dec3..ebf11bcc7 100644
--- a/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
+++ b/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
@@ -33,37 +33,43 @@ func (ctrl *RenderSecretsStaticPodController) Name() string {
 	return "k8s.RenderSecretsStaticPodController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *RenderSecretsStaticPodController) ManagedResources() (resource.Namespace, resource.Type) {
-	return k8s.ControlPlaneNamespaceName, k8s.SecretsStatusType
+// Inputs implements controller.Controller interface.
+func (ctrl *RenderSecretsStaticPodController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.RootType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.KubernetesType,
+			ID:        pointer.ToString(secrets.KubernetesID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.EtcdType,
+			ID:        pointer.ToString(secrets.EtcdID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *RenderSecretsStaticPodController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: k8s.SecretsStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo,cyclop
 func (ctrl *RenderSecretsStaticPodController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.RootType,
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.KubernetesType,
-			ID:        pointer.ToString(secrets.KubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.EtcdType,
-			ID:        pointer.ToString(secrets.EtcdID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -291,7 +297,7 @@ func (ctrl *RenderSecretsStaticPodController) Run(ctx context.Context, r control
 			}
 		}
 
-		if err = r.Update(ctx, k8s.NewSecretsStatus(k8s.ControlPlaneNamespaceName, k8s.StaticPodSecretsStaticPodID), func(r resource.Resource) error {
+		if err = r.Modify(ctx, k8s.NewSecretsStatus(k8s.ControlPlaneNamespaceName, k8s.StaticPodSecretsStaticPodID), func(r resource.Resource) error {
 			r.(*k8s.SecretsStatus).Status().Ready = true
 			r.(*k8s.SecretsStatus).Status().Version = secretsRes.Metadata().Version().String()
 
diff --git a/internal/app/machined/pkg/controllers/secrets/etcd.go b/internal/app/machined/pkg/controllers/secrets/etcd.go
index b0e5ec230..6a1804989 100644
--- a/internal/app/machined/pkg/controllers/secrets/etcd.go
+++ b/internal/app/machined/pkg/controllers/secrets/etcd.go
@@ -28,38 +28,44 @@ func (ctrl *EtcdController) Name() string {
 	return "secrets.EtcdController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *EtcdController) ManagedResources() (resource.Namespace, resource.Type) {
-	return secrets.NamespaceName, secrets.EtcdType
+// Inputs implements controller.Controller interface.
+func (ctrl *EtcdController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.RootType,
+			ID:        pointer.ToString(secrets.RootEtcdID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.ServiceType,
+			ID:        pointer.ToString("networkd"),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      time.StatusType,
+			ID:        pointer.ToString(time.StatusID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *EtcdController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: secrets.EtcdType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *EtcdController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.RootType,
-			ID:        pointer.ToString(secrets.RootEtcdID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.ServiceType,
-			ID:        pointer.ToString("networkd"),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      time.StatusType,
-			ID:        pointer.ToString(time.StatusID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -110,7 +116,7 @@ func (ctrl *EtcdController) Run(ctx context.Context, r controller.Runtime, logge
 			continue
 		}
 
-		if err = r.Update(ctx, secrets.NewEtcd(), func(r resource.Resource) error {
+		if err = r.Modify(ctx, secrets.NewEtcd(), func(r resource.Resource) error {
 			return ctrl.updateSecrets(etcdRoot, r.(*secrets.Etcd).Certs())
 		}); err != nil {
 			return err
diff --git a/internal/app/machined/pkg/controllers/secrets/kubernetes.go b/internal/app/machined/pkg/controllers/secrets/kubernetes.go
index e2ca38755..1d46f0ec2 100644
--- a/internal/app/machined/pkg/controllers/secrets/kubernetes.go
+++ b/internal/app/machined/pkg/controllers/secrets/kubernetes.go
@@ -40,38 +40,44 @@ func (ctrl *KubernetesController) Name() string {
 	return "secrets.KubernetesController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *KubernetesController) ManagedResources() (resource.Namespace, resource.Type) {
-	return secrets.NamespaceName, secrets.KubernetesType
+// Inputs implements controller.Controller interface.
+func (ctrl *KubernetesController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: secrets.NamespaceName,
+			Type:      secrets.RootType,
+			ID:        pointer.ToString(secrets.RootKubernetesID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      v1alpha1.ServiceType,
+			ID:        pointer.ToString("networkd"),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: v1alpha1.NamespaceName,
+			Type:      timeresource.StatusType,
+			ID:        pointer.ToString(timeresource.StatusID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *KubernetesController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: secrets.KubernetesType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *KubernetesController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: secrets.NamespaceName,
-			Type:      secrets.RootType,
-			ID:        pointer.ToString(secrets.RootKubernetesID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      v1alpha1.ServiceType,
-			ID:        pointer.ToString("networkd"),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: v1alpha1.NamespaceName,
-			Type:      timeresource.StatusType,
-			ID:        pointer.ToString(timeresource.StatusID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	refreshTicker := time.NewTicker(KubernetesCertificateValidityDuration / 2)
 	defer refreshTicker.Stop()
 
@@ -126,7 +132,7 @@ func (ctrl *KubernetesController) Run(ctx context.Context, r controller.Runtime,
 			continue
 		}
 
-		if err = r.Update(ctx, secrets.NewKubernetes(), func(r resource.Resource) error {
+		if err = r.Modify(ctx, secrets.NewKubernetes(), func(r resource.Resource) error {
 			return ctrl.updateSecrets(k8sRoot, r.(*secrets.Kubernetes).Certs())
 		}); err != nil {
 			return err
diff --git a/internal/app/machined/pkg/controllers/secrets/root.go b/internal/app/machined/pkg/controllers/secrets/root.go
index 38d98ff51..d695e59b5 100644
--- a/internal/app/machined/pkg/controllers/secrets/root.go
+++ b/internal/app/machined/pkg/controllers/secrets/root.go
@@ -28,32 +28,38 @@ func (ctrl *RootController) Name() string {
 	return "secrets.RootController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *RootController) ManagedResources() (resource.Namespace, resource.Type) {
-	return secrets.NamespaceName, secrets.RootType
+// Inputs implements controller.Controller interface.
+func (ctrl *RootController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineConfigType,
+			ID:        pointer.ToString(config.V1Alpha1ID),
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineTypeType,
+			ID:        pointer.ToString(config.MachineTypeID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *RootController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: secrets.RootType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
 //
 //nolint:gocyclo
 func (ctrl *RootController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.MachineConfigType,
-			ID:        pointer.ToString(config.V1Alpha1ID),
-			Kind:      controller.DependencyWeak,
-		},
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.MachineTypeType,
-			ID:        pointer.ToString(config.MachineTypeID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	for {
 		select {
 		case <-ctx.Done():
@@ -95,13 +101,13 @@ func (ctrl *RootController) Run(ctx context.Context, r controller.Runtime, logge
 			continue
 		}
 
-		if err = r.Update(ctx, secrets.NewRoot(secrets.RootEtcdID), func(r resource.Resource) error {
+		if err = r.Modify(ctx, secrets.NewRoot(secrets.RootEtcdID), func(r resource.Resource) error {
 			return ctrl.updateEtcdSecrets(cfgProvider, r.(*secrets.Root).EtcdSpec())
 		}); err != nil {
 			return err
 		}
 
-		if err = r.Update(ctx, secrets.NewRoot(secrets.RootKubernetesID), func(r resource.Resource) error {
+		if err = r.Modify(ctx, secrets.NewRoot(secrets.RootKubernetesID), func(r resource.Resource) error {
 			return ctrl.updateK8sSecrets(cfgProvider, r.(*secrets.Root).KubernetesSpec())
 		}); err != nil {
 			return err
diff --git a/internal/app/machined/pkg/controllers/time/sync.go b/internal/app/machined/pkg/controllers/time/sync.go
index e31296a75..ea0b78fa0 100644
--- a/internal/app/machined/pkg/controllers/time/sync.go
+++ b/internal/app/machined/pkg/controllers/time/sync.go
@@ -20,7 +20,6 @@ import (
 	"github.com/talos-systems/talos/pkg/machinery/constants"
 	"github.com/talos-systems/talos/pkg/resources/config"
 	"github.com/talos-systems/talos/pkg/resources/time"
-	"github.com/talos-systems/talos/pkg/resources/v1alpha1"
 )
 
 // SyncController manages v1alpha1.TimeSync based on configuration and NTP sync process.
@@ -34,9 +33,26 @@ func (ctrl *SyncController) Name() string {
 	return "time.SyncController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *SyncController) ManagedResources() (resource.Namespace, resource.Type) {
-	return v1alpha1.NamespaceName, time.StatusType
+// Inputs implements controller.Controller interface.
+func (ctrl *SyncController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineConfigType,
+			ID:        pointer.ToString(config.V1Alpha1ID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *SyncController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: time.StatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // NTPSyncer interface is implemented by ntp.Syncer, interface for mocking.
@@ -60,17 +76,6 @@ func (ctrl *SyncController) Run(ctx context.Context, r controller.Runtime, logge
 		}
 	}
 
-	if err := r.UpdateDependencies([]controller.Dependency{
-		{
-			Namespace: config.NamespaceName,
-			Type:      config.MachineConfigType,
-			ID:        pointer.ToString(config.V1Alpha1ID),
-			Kind:      controller.DependencyWeak,
-		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
-	}
-
 	var (
 		syncCtx       context.Context
 		syncCtxCancel context.CancelFunc
@@ -163,7 +168,7 @@ func (ctrl *SyncController) Run(ctx context.Context, r controller.Runtime, logge
 			timeSynced = true
 		}
 
-		if err = r.Update(ctx, time.NewStatus(), func(r resource.Resource) error {
+		if err = r.Modify(ctx, time.NewStatus(), func(r resource.Resource) error {
 			r.(*time.Status).SetStatus(time.StatusSpec{
 				Epoch:        epoch,
 				Synced:       timeSynced,
diff --git a/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go b/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
index e225f206f..97f9b31b0 100644
--- a/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
+++ b/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
@@ -31,24 +31,30 @@ func (ctrl *BootstrapStatusController) Name() string {
 	return "v1alpha1.BootstrapStatusController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *BootstrapStatusController) ManagedResources() (resource.Namespace, resource.Type) {
-	return v1alpha1.NamespaceName, v1alpha1.BootstrapStatusType
-}
-
-// Run implements controller.Controller interface.
-func (ctrl *BootstrapStatusController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
-	if err := r.UpdateDependencies([]controller.Dependency{
+// Inputs implements controller.Controller interface.
+func (ctrl *BootstrapStatusController) Inputs() []controller.Input {
+	return []controller.Input{
 		{
 			Namespace: v1alpha1.NamespaceName,
 			Type:      v1alpha1.ServiceType,
 			ID:        pointer.ToString("etcd"),
-			Kind:      controller.DependencyWeak,
+			Kind:      controller.InputWeak,
 		},
-	}); err != nil {
-		return fmt.Errorf("error setting up dependencies: %w", err)
 	}
+}
 
+// Outputs implements controller.Controller interface.
+func (ctrl *BootstrapStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: v1alpha1.BootstrapStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *BootstrapStatusController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	for {
 		select {
 		case <-ctx.Done():
@@ -102,7 +108,7 @@ func (ctrl *BootstrapStatusController) readInitialized(ctx context.Context, r co
 	if resp.Count == 0 || string(resp.Kvs[0].Value) != "true" {
 		logger.Printf("bootkube initialized status not found")
 
-		return r.Update(ctx, v1alpha1.NewBootstrapStatus(), func(r resource.Resource) error {
+		return r.Modify(ctx, v1alpha1.NewBootstrapStatus(), func(r resource.Resource) error {
 			r.(*v1alpha1.BootstrapStatus).Status().SelfHostedControlPlane = false
 
 			return nil
@@ -111,7 +117,7 @@ func (ctrl *BootstrapStatusController) readInitialized(ctx context.Context, r co
 
 	logger.Printf("found bootkube initialized status in etcd")
 
-	if err = r.Update(ctx, v1alpha1.NewBootstrapStatus(), func(r resource.Resource) error {
+	if err = r.Modify(ctx, v1alpha1.NewBootstrapStatus(), func(r resource.Resource) error {
 		r.(*v1alpha1.BootstrapStatus).Status().SelfHostedControlPlane = true
 
 		return nil
diff --git a/internal/app/machined/pkg/controllers/v1alpha1/service.go b/internal/app/machined/pkg/controllers/v1alpha1/service.go
index fc64eb0f7..2088e0e33 100644
--- a/internal/app/machined/pkg/controllers/v1alpha1/service.go
+++ b/internal/app/machined/pkg/controllers/v1alpha1/service.go
@@ -28,9 +28,19 @@ func (ctrl *ServiceController) Name() string {
 	return "v1alpha1.ServiceController"
 }
 
-// ManagedResources implements controller.Controller interface.
-func (ctrl *ServiceController) ManagedResources() (resource.Namespace, resource.Type) {
-	return v1alpha1.NamespaceName, v1alpha1.ServiceType
+// Inputs implements controller.Controller interface.
+func (ctrl *ServiceController) Inputs() []controller.Input {
+	return nil
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ServiceController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: v1alpha1.ServiceType,
+			Kind: controller.OutputExclusive,
+		},
+	}
 }
 
 // Run implements controller.Controller interface.
@@ -64,7 +74,7 @@ func (ctrl *ServiceController) Run(ctx context.Context, r controller.Runtime, lo
 
 				switch msg.Action { //nolint:exhaustive
 				case machine.ServiceStateEvent_RUNNING:
-					if err := r.Update(ctx, service, func(r resource.Resource) error {
+					if err := r.Modify(ctx, service, func(r resource.Resource) error {
 						svc := r.(*v1alpha1.Service) //nolint:errcheck,forcetypeassert
 
 						svc.SetRunning(true)
diff --git a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
index 14b1b2d1b..40845482d 100644
--- a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
+++ b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
@@ -60,10 +60,6 @@ func NewState() (*State, error) {
 		return nil, err
 	}
 
-	if err := s.namespaceRegistry.Register(ctx, k8s.ExtraNamespaceName, "Kubernetes extra configuration resources."); err != nil {
-		return nil, err
-	}
-
 	if err := s.namespaceRegistry.Register(ctx, secrets.NamespaceName, "Resources with secret material."); err != nil {
 		return nil, err
 	}
diff --git a/pkg/machinery/api/inspect/inspect.pb.go b/pkg/machinery/api/inspect/inspect.pb.go
index 52ff7f607..58620e2c3 100644
--- a/pkg/machinery/api/inspect/inspect.pb.go
+++ b/pkg/machinery/api/inspect/inspect.pb.go
@@ -27,22 +27,25 @@ const (
 type DependencyEdgeType int32
 
 const (
-	DependencyEdgeType_MANAGES DependencyEdgeType = 0
-	DependencyEdgeType_STRONG  DependencyEdgeType = 1
-	DependencyEdgeType_WEAK    DependencyEdgeType = 2
+	DependencyEdgeType_OUTPUT_EXCLUSIVE DependencyEdgeType = 0
+	DependencyEdgeType_OUTPUT_SHARED    DependencyEdgeType = 3
+	DependencyEdgeType_INPUT_STRONG     DependencyEdgeType = 1
+	DependencyEdgeType_INPUT_WEAK       DependencyEdgeType = 2
 )
 
 // Enum value maps for DependencyEdgeType.
 var (
 	DependencyEdgeType_name = map[int32]string{
-		0: "MANAGES",
-		1: "STRONG",
-		2: "WEAK",
+		0: "OUTPUT_EXCLUSIVE",
+		3: "OUTPUT_SHARED",
+		1: "INPUT_STRONG",
+		2: "INPUT_WEAK",
 	}
 	DependencyEdgeType_value = map[string]int32{
-		"MANAGES": 0,
-		"STRONG":  1,
-		"WEAK":    2,
+		"OUTPUT_EXCLUSIVE": 0,
+		"OUTPUT_SHARED":    3,
+		"INPUT_STRONG":     1,
+		"INPUT_WEAK":       2,
 	}
 )
 
@@ -231,7 +234,7 @@ func (x *ControllerDependencyEdge) GetEdgeType() DependencyEdgeType {
 	if x != nil {
 		return x.EdgeType
 	}
-	return DependencyEdgeType_MANAGES
+	return DependencyEdgeType_OUTPUT_EXCLUSIVE
 }
 
 func (x *ControllerDependencyEdge) GetResourceNamespace() string {
@@ -293,24 +296,27 @@ var file_inspect_inspect_proto_rawDesc = []byte{
 	0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x2a, 0x37, 0x0a, 0x12, 0x44, 0x65, 0x70,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x2a, 0x5f, 0x0a, 0x12, 0x44, 0x65, 0x70,
 	0x65, 0x6e, 0x64, 0x65, 0x6e, 0x63, 0x79, 0x45, 0x64, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12,
-	0x0b, 0x0a, 0x07, 0x4d, 0x41, 0x4e, 0x41, 0x47, 0x45, 0x53, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06,
-	0x53, 0x54, 0x52, 0x4f, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x45, 0x41, 0x4b,
-	0x10, 0x02, 0x32, 0x79, 0x0a, 0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x67, 0x0a, 0x1d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x44, 0x65, 0x70, 0x65, 0x6e, 0x64, 0x65,
-	0x6e, 0x63, 0x69, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x2e, 0x2e,
-	0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x2e, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x44, 0x65, 0x70, 0x65, 0x6e, 0x64, 0x65,
-	0x6e, 0x63, 0x69, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x59, 0x0a,
-	0x0f, 0x63, 0x6f, 0x6d, 0x2e, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x2e, 0x61, 0x70, 0x69,
-	0x42, 0x0a, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x41, 0x70, 0x69, 0x50, 0x01, 0x5a, 0x38,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73,
-	0x2d, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2f, 0x70,
-	0x6b, 0x67, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x14, 0x0a, 0x10, 0x4f, 0x55, 0x54, 0x50, 0x55, 0x54, 0x5f, 0x45, 0x58, 0x43, 0x4c, 0x55, 0x53,
+	0x49, 0x56, 0x45, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4f, 0x55, 0x54, 0x50, 0x55, 0x54, 0x5f,
+	0x53, 0x48, 0x41, 0x52, 0x45, 0x44, 0x10, 0x03, 0x12, 0x10, 0x0a, 0x0c, 0x49, 0x4e, 0x50, 0x55,
+	0x54, 0x5f, 0x53, 0x54, 0x52, 0x4f, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x49, 0x4e,
+	0x50, 0x55, 0x54, 0x5f, 0x57, 0x45, 0x41, 0x4b, 0x10, 0x02, 0x32, 0x79, 0x0a, 0x0e, 0x49, 0x6e,
+	0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x67, 0x0a, 0x1d,
+	0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x44, 0x65, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x6e, 0x63, 0x69, 0x65, 0x73, 0x12, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x2e, 0x2e, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x2e,
+	0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x44, 0x65, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x6e, 0x63, 0x69, 0x65, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x59, 0x0a, 0x0f, 0x63, 0x6f, 0x6d, 0x2e, 0x69, 0x6e, 0x73,
+	0x70, 0x65, 0x63, 0x74, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x0a, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
+	0x74, 0x41, 0x70, 0x69, 0x50, 0x01, 0x5a, 0x38, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2d, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73,
+	0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/pkg/machinery/api/resource/resource.pb.go b/pkg/machinery/api/resource/resource.pb.go
index edc5642be..e9200577d 100644
--- a/pkg/machinery/api/resource/resource.pb.go
+++ b/pkg/machinery/api/resource/resource.pb.go
@@ -136,6 +136,7 @@ type Metadata struct {
 	Type       string   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
 	Id         string   `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
 	Version    string   `protobuf:"bytes,4,opt,name=version,proto3" json:"version,omitempty"`
+	Owner      string   `protobuf:"bytes,7,opt,name=owner,proto3" json:"owner,omitempty"`
 	Phase      string   `protobuf:"bytes,5,opt,name=phase,proto3" json:"phase,omitempty"`
 	Finalizers []string `protobuf:"bytes,6,rep,name=finalizers,proto3" json:"finalizers,omitempty"`
 }
@@ -200,6 +201,13 @@ func (x *Metadata) GetVersion() string {
 	return ""
 }
 
+func (x *Metadata) GetOwner() string {
+	if x != nil {
+		return x.Owner
+	}
+	return ""
+}
+
 func (x *Metadata) GetPhase() string {
 	if x != nil {
 		return x.Phase
@@ -704,91 +712,93 @@ var file_resource_resource_proto_rawDesc = []byte{
 	0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
 	0x64, 0x61, 0x74, 0x61, 0x12, 0x22, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x70,
-	0x65, 0x63, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22, 0x9c, 0x01, 0x0a, 0x08, 0x4d, 0x65, 0x74,
+	0x65, 0x63, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22, 0xb2, 0x01, 0x0a, 0x08, 0x4d, 0x65, 0x74,
 	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
 	0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
 	0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x03, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
 	0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x12, 0x14, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x66, 0x69, 0x6e, 0x61, 0x6c,
-	0x69, 0x7a, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x66, 0x69, 0x6e,
-	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x72, 0x73, 0x22, 0x1a, 0x0a, 0x04, 0x53, 0x70, 0x65, 0x63, 0x12,
-	0x12, 0x0a, 0x04, 0x79, 0x61, 0x6d, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x79,
-	0x61, 0x6d, 0x6c, 0x22, 0x4e, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x6e, 0x12, 0x14, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x1e, 0x0a,
+	0x0a, 0x66, 0x69, 0x6e, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0a, 0x66, 0x69, 0x6e, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x72, 0x73, 0x22, 0x1a, 0x0a,
+	0x04, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x79, 0x61, 0x6d, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x04, 0x79, 0x61, 0x6d, 0x6c, 0x22, 0x4e, 0x0a, 0x0a, 0x47, 0x65, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x97, 0x01, 0x0a, 0x03, 0x47, 0x65,
+	0x74, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x32, 0x0a, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x22, 0x38, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x29, 0x0a, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
+	0x47, 0x65, 0x74, 0x52, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0x3f, 0x0a,
+	0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xa0,
+	0x01, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x32, 0x0a,
+	0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x2e, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x22, 0x50, 0x0a, 0x0c, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12,
 	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
 	0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x22, 0x97, 0x01, 0x0a, 0x03, 0x47, 0x65, 0x74, 0x12, 0x2c, 0x0a, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x32, 0x0a, 0x0a, 0x64, 0x65, 0x66,
-	0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x38, 0x0a,
-	0x0b, 0x47, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x29, 0x0a, 0x08,
-	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x08, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0x3f, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xa0, 0x01, 0x0a, 0x0c, 0x4c, 0x69, 0x73,
-	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x32, 0x0a, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65,
+	0x02, 0x69, 0x64, 0x22, 0xd5, 0x01, 0x0a, 0x0d, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x32, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x13, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x09, 0x65, 0x76,
+	0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x32, 0x0a, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65,
 	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
 	0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x08, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e,
 	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0c, 0x57,
-	0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0xd5, 0x01,
-	0x0a, 0x0d, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x32, 0x0a,
-	0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x13, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70,
-	0x65, 0x12, 0x32, 0x0a, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2a, 0x34, 0x0a, 0x09, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12,
-	0x0b, 0x0a, 0x07, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09,
-	0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x45, 0x44, 0x10, 0x02, 0x32, 0xba, 0x01, 0x0a, 0x0f,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
-	0x32, 0x0a, 0x03, 0x47, 0x65, 0x74, 0x12, 0x14, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x15, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x3a, 0x0a, 0x05,
-	0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x16, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x42, 0x5c, 0x0a, 0x10, 0x63, 0x6f, 0x6d, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x0b, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x70, 0x69, 0x50, 0x01, 0x5a, 0x39, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2d, 0x73, 0x79,
-	0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6b, 0x67, 0x2f,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2a, 0x34, 0x0a, 0x09, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x52, 0x45, 0x41,
+	0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x44,
+	0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x45, 0x44, 0x10,
+	0x02, 0x32, 0xba, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x32, 0x0a, 0x03, 0x47, 0x65, 0x74, 0x12, 0x14, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x47, 0x65,
+	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x04, 0x4c, 0x69, 0x73,
+	0x74, 0x12, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x30, 0x01, 0x12, 0x3a, 0x0a, 0x05, 0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x16, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57,
+	0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x42, 0x5c,
+	0x0a, 0x10, 0x63, 0x6f, 0x6d, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x61,
+	0x70, 0x69, 0x42, 0x0b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x70, 0x69, 0x50,
+	0x01, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x61,
+	0x6c, 0x6f, 0x73, 0x2d, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x2f, 0x74, 0x61, 0x6c, 0x6f,
+	0x73, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x72, 0x79, 0x2f,
+	0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/pkg/machinery/go.mod b/pkg/machinery/go.mod
index b79a13bc0..1cd5846f3 100644
--- a/pkg/machinery/go.mod
+++ b/pkg/machinery/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/talos-systems/crypto v0.2.1-0.20210202170911-39584f1b6e54
 	github.com/talos-systems/go-blockdevice v0.2.1-0.20210401182259-bec914ffdda4
 	github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa
-	github.com/talos-systems/os-runtime v0.0.0-20210303124137-84c3c875eb2b
+	github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4
 	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 // indirect
 	golang.org/x/text v0.3.5 // indirect
 	google.golang.org/genproto v0.0.0-20210302174412-5ede27ff9881
diff --git a/pkg/machinery/go.sum b/pkg/machinery/go.sum
index 48ac3765f..97949f9c5 100644
--- a/pkg/machinery/go.sum
+++ b/pkg/machinery/go.sum
@@ -58,7 +58,7 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-memdb v1.3.0/go.mod h1:Mluclgwib3R93Hk5fxEfiRhB+6Dar64wWh71LpNSe3g=
+github.com/hashicorp/go-memdb v1.3.2/go.mod h1:Mluclgwib3R93Hk5fxEfiRhB+6Dar64wWh71LpNSe3g=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -109,11 +109,11 @@ github.com/talos-systems/go-blockdevice v0.2.1-0.20210401182259-bec914ffdda4 h1:
 github.com/talos-systems/go-blockdevice v0.2.1-0.20210401182259-bec914ffdda4/go.mod h1:qnn/zDc09I1DA2BUDDCOSA2D0P8pIDjN8pGiRoRaQig=
 github.com/talos-systems/go-cmd v0.0.0-20210216164758-68eb0067e0f0/go.mod h1:kf+rZzTEmlDiYQ6ulslvRONnKLQH8x83TowltGMhO+k=
 github.com/talos-systems/go-retry v0.1.1-0.20201113203059-8c63d290a688/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
-github.com/talos-systems/go-retry v0.2.0/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
+github.com/talos-systems/go-retry v0.2.1-0.20210119124456-b9dc1a990133/go.mod h1:HiXQqyVStZ35uSY/MTLWVvQVmC3lIW2MS5VdDaMtoKM=
 github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa h1:XqOMTt0Q6mjsk8Dea5wUpgcdtf+AzesH11m4AozWSxw=
 github.com/talos-systems/net v0.2.1-0.20210212213224-05190541b0fa/go.mod h1:VreSAyRmxMtqussAHSKMKkJQa1YwBTSVfkmE4Jydam4=
-github.com/talos-systems/os-runtime v0.0.0-20210303124137-84c3c875eb2b h1:QM8V1t0QivzQzl4uuTkFDSlNzdUyG1/8bRAVwDRPQIo=
-github.com/talos-systems/os-runtime v0.0.0-20210303124137-84c3c875eb2b/go.mod h1:Z+1phKVJ0IWH+Jd2DGufL8WKqxd3xt1xlcsxcU18ZL0=
+github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4 h1:mVlqonAE7QgFWn1g9p2b+EBC4Lk57TexASvp7tHglRc=
+github.com/talos-systems/os-runtime v0.0.0-20210401122348-86d9e090bdc4/go.mod h1:358qvRxAR16NdF8fiitixPgECx4Pj32yXLHAWYWZc/g=
 github.com/unix4ever/yaml v0.0.0-20210315173758-8fb30b8e5a5b h1:8pnPjZJU0SYanlmHnhMTeR8OR148K9yStwBz1GsjBsQ=
 github.com/unix4ever/yaml v0.0.0-20210315173758-8fb30b8e5a5b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -142,8 +142,9 @@ golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAG
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9 h1:SQFwaSi55rU7vdNs9Yr0Z324VNlrF+0wMqRXT4St8ck=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/pkg/resources/k8s/k8s.go b/pkg/resources/k8s/k8s.go
index a37a61869..d42e7d316 100644
--- a/pkg/resources/k8s/k8s.go
+++ b/pkg/resources/k8s/k8s.go
@@ -9,6 +9,3 @@ import "github.com/talos-systems/os-runtime/pkg/resource"
 
 // ControlPlaneNamespaceName contains resources supporting Kubernetes control plane.
 const ControlPlaneNamespaceName resource.Namespace = "controlplane"
-
-// ExtraNamespaceName contains extra resources related to Kubernnetes configuration.
-const ExtraNamespaceName resource.Namespace = "extras"
diff --git a/website/content/docs/v0.10/Guides/converting-control-plane.md b/website/content/docs/v0.10/Guides/converting-control-plane.md
index d68f2d5c2..d7ec2ead6 100644
--- a/website/content/docs/v0.10/Guides/converting-control-plane.md
+++ b/website/content/docs/v0.10/Guides/converting-control-plane.md
@@ -95,7 +95,7 @@ If you have non-standard apiserver aggregations (fairly rare, and you should kno
 Verify that bootstrap manifests are correct:
 
 ```bash
-$ talosctl -n <IP> get manifests --namespace controlplane
+$ talosctl -n <IP> get manifests
 NODE         NAMESPACE      TYPE       ID                               VERSION
 172.20.0.2   controlplane   Manifest   00-kubelet-bootstrapping-token   1
 172.20.0.2   controlplane   Manifest   01-csr-approver-role-binding     1
@@ -103,18 +103,13 @@ NODE         NAMESPACE      TYPE       ID                               VERSION
 172.20.0.2   controlplane   Manifest   01-csr-renewal-role-binding      1
 172.20.0.2   controlplane   Manifest   02-kube-system-sa-role-binding   1
 172.20.0.2   controlplane   Manifest   03-default-pod-security-policy   1
+172.20.0.2   controlplane   Manifest   05-https://docs.projectcalico.org/manifests/calico.yaml   1
 172.20.0.2   controlplane   Manifest   10-kube-proxy                    1
 172.20.0.2   controlplane   Manifest   11-core-dns                      1
 172.20.0.2   controlplane   Manifest   11-core-dns-svc                  1
 172.20.0.2   controlplane   Manifest   11-kube-config-in-cluster        1
 ```
 
-```bash
-$ talosctl -n <IP> get manifests --namespace=extras
-NODE         NAMESPACE   TYPE       ID                                                        VERSION
-172.20.0.2   extras      Manifest   05-https://docs.projectcalico.org/manifests/calico.yaml   1
-```
-
 Make sure that manifests and static pods are correct across all control plane nodes, as each node reconciles
 control plane state on its own.
 For example, CNI configuration in machine config should be in sync across all the nodes.
diff --git a/website/content/docs/v0.10/Guides/troubleshooting-control-plane.md b/website/content/docs/v0.10/Guides/troubleshooting-control-plane.md
index e910b57f8..757427370 100644
--- a/website/content/docs/v0.10/Guides/troubleshooting-control-plane.md
+++ b/website/content/docs/v0.10/Guides/troubleshooting-control-plane.md
@@ -383,7 +383,7 @@ As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes
 There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config):
 
 ```bash
-$ talosctl -n <IP> get manifests --namespace=controlplane
+$ talosctl -n <IP> get manifests
 NODE         NAMESPACE      TYPE       ID                               VERSION
 172.20.0.2   controlplane   Manifest   00-kubelet-bootstrapping-token   1
 172.20.0.2   controlplane   Manifest   01-csr-approver-role-binding     1
@@ -391,18 +391,13 @@ NODE         NAMESPACE      TYPE       ID                               VERSION
 172.20.0.2   controlplane   Manifest   01-csr-renewal-role-binding      1
 172.20.0.2   controlplane   Manifest   02-kube-system-sa-role-binding   1
 172.20.0.2   controlplane   Manifest   03-default-pod-security-policy   1
+172.20.0.2   controlplane   Manifest   05-https://docs.projectcalico.org/manifests/calico.yaml   1
 172.20.0.2   controlplane   Manifest   10-kube-proxy                    1
 172.20.0.2   controlplane   Manifest   11-core-dns                      1
 172.20.0.2   controlplane   Manifest   11-core-dns-svc                  1
 172.20.0.2   controlplane   Manifest   11-kube-config-in-cluster        1
 ```
 
-```bash
-$ talosctl -n <IP> get manifests --namespace=extras
-NODE         NAMESPACE   TYPE       ID                                                        VERSION
-172.20.0.2   extras      Manifest   05-https://docs.projectcalico.org/manifests/calico.yaml   1
-```
-
 Details of each manifests can be queried by adding `-o yaml`:
 
 ```bash
diff --git a/website/content/docs/v0.10/Learn More/controllers-resources.md b/website/content/docs/v0.10/Learn More/controllers-resources.md
index 925a0cf16..8828b5780 100644
--- a/website/content/docs/v0.10/Learn More/controllers-resources.md	
+++ b/website/content/docs/v0.10/Learn More/controllers-resources.md	
@@ -74,7 +74,6 @@ $ talosctl get namespaces
 NODE         NAMESPACE   TYPE        ID             VERSION
 172.20.0.2   meta        Namespace   config         1
 172.20.0.2   meta        Namespace   controlplane   1
-172.20.0.2   meta        Namespace   extras         1
 172.20.0.2   meta        Namespace   meta           1
 172.20.0.2   meta        Namespace   runtime        1
 172.20.0.2   meta        Namespace   secrets        1
@@ -223,7 +222,7 @@ This outputs graph in `graphviz` format which can be rendered to PNG with comman
 talosctl inspect dependencies | dot -T png > deps.png
 ```
 
-![Controller Dependencies](/images/controller-dependencies.png)
+![Controller Dependencies](/images/controller-dependencies-v2.png)
 
 Graph can be enhanced by replacing resource types with actual resource instances:
 
@@ -231,4 +230,4 @@ Graph can be enhanced by replacing resource types with actual resource instances
 talosctl inspect dependencies --with-resources | dot -T png > deps.png
 ```
 
-![Controller Dependencies with Resources](/images/controller-dependencies-with-resources.png)
+![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png)
diff --git a/website/content/docs/v0.10/Reference/api.md b/website/content/docs/v0.10/Reference/api.md
index ba6eb751d..0feef5ef8 100644
--- a/website/content/docs/v0.10/Reference/api.md
+++ b/website/content/docs/v0.10/Reference/api.md
@@ -566,9 +566,10 @@ The ControllerRuntimeDependency message contains the graph of controller-resourc
 
 | Name | Number | Description |
 | ---- | ------ | ----------- |
-| MANAGES | 0 |  |
-| STRONG | 1 |  |
-| WEAK | 2 |  |
+| OUTPUT_EXCLUSIVE | 0 |  |
+| OUTPUT_SHARED | 3 |  |
+| INPUT_STRONG | 1 |  |
+| INPUT_WEAK | 2 |  |
 
 
  <!-- end enums -->
@@ -3190,6 +3191,7 @@ The ListResponse message contains the Resource returned.
 | type | [string](#string) |  |  |
 | id | [string](#string) |  |  |
 | version | [string](#string) |  |  |
+| owner | [string](#string) |  |  |
 | phase | [string](#string) |  |  |
 | finalizers | [string](#string) | repeated |  |
 
diff --git a/website/static/images/controller-dependencies-v2.png b/website/static/images/controller-dependencies-v2.png
new file mode 100644
index 000000000..62d5b3e16
Binary files /dev/null and b/website/static/images/controller-dependencies-v2.png differ
diff --git a/website/static/images/controller-dependencies-with-resources-v2.png b/website/static/images/controller-dependencies-with-resources-v2.png
new file mode 100644
index 000000000..0150a98d6
Binary files /dev/null and b/website/static/images/controller-dependencies-with-resources-v2.png differ