diff --git a/go.mod b/go.mod
index b89ca3f43d..af85ec178e 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,6 @@ replace (
 	github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.2
 	github.com/opencontainers/runtime-spec => github.com/opencontainers/runtime-spec v1.0.3-0.20210316141917-a8c4a9ee0f6b
 	github.com/rancher/k3s/pkg/data => ./pkg/data
-	github.com/rancher/wrangler => github.com/rancher/wrangler v0.8.5
 	go.etcd.io/etcd/api/v3 => github.com/k3s-io/etcd/api/v3 v3.5.0-k3s2
 	go.etcd.io/etcd/client/v3 => github.com/k3s-io/etcd/client/v3 v3.5.0-k3s2
 	go.etcd.io/etcd/etcdutl/v3 => github.com/k3s-io/etcd/etcdutl/v3 v3.5.0-k3s2
@@ -110,7 +109,7 @@ require (
 	github.com/rancher/lasso v0.0.0-20210616224652-fc3ebd901c08
 	github.com/rancher/remotedialer v0.2.0
 	github.com/rancher/wharfie v0.3.4
-	github.com/rancher/wrangler v0.8.3
+	github.com/rancher/wrangler v0.8.8
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/rootless-containers/rootlesskit v0.14.5
 	github.com/sirupsen/logrus v1.8.1
diff --git a/go.sum b/go.sum
index 5f6812ed04..8da14e58f6 100644
--- a/go.sum
+++ b/go.sum
@@ -871,8 +871,9 @@ github.com/rancher/remotedialer v0.2.0 h1:xD7t3K6JYwTdAsxmGtTHQMkEkFgKouQ1foLxVW
 github.com/rancher/remotedialer v0.2.0/go.mod h1:tkU8ZvrR5lRgaKWaX71nAy6daeqvPFx/lJEnbW7tXSI=
 github.com/rancher/wharfie v0.3.4 h1:wVqFW1cyRA20zY90Z56VrjG0lWg3oFmf/4ryr5Dkkis=
 github.com/rancher/wharfie v0.3.4/go.mod h1:cb8mSczpmw7ItbPF3K1W7crWuJLVdyV49sZZuaY4BS8=
-github.com/rancher/wrangler v0.8.5 h1:aHUVvJrOhD6CGrAELWKDpo1MBDC8vKtEQZvjMPnw2cs=
-github.com/rancher/wrangler v0.8.5/go.mod h1:dKEaHNB4izxmPUtpq1Hvr3z3Oh+9k5pCZyFO9sUhlaY=
+github.com/rancher/wrangler v0.8.3/go.mod h1:dKEaHNB4izxmPUtpq1Hvr3z3Oh+9k5pCZyFO9sUhlaY=
+github.com/rancher/wrangler v0.8.8 h1:3EEQmfUqZ/UG4hERHhihB+Q2F1s/W4CmfsPmXv17wS8=
+github.com/rancher/wrangler v0.8.8/go.mod h1:dKEaHNB4izxmPUtpq1Hvr3z3Oh+9k5pCZyFO9sUhlaY=
 github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uYEyJGbgTkfkS4+E/PavXkNJcbFIpEtjt2B0KDQ5+9M=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
diff --git a/pkg/agent/containerd/containerd.go b/pkg/agent/containerd/containerd.go
index 2fe5bcb5a7..51c144d388 100644
--- a/pkg/agent/containerd/containerd.go
+++ b/pkg/agent/containerd/containerd.go
@@ -86,7 +86,7 @@ func Run(ctx context.Context, cfg *config.Node) error {
 		}
 
 		logrus.Infof("Running containerd %s", config.ArgString(args[1:]))
-		cmd := exec.Command(args[0], args[1:]...)
+		cmd := exec.CommandContext(ctx, args[0], args[1:]...)
 		cmd.Stdout = stdOut
 		cmd.Stderr = stdErr
 		cmd.Env = env
diff --git a/pkg/cli/agent/agent.go b/pkg/cli/agent/agent.go
index 608209ffd8..0872f251d4 100644
--- a/pkg/cli/agent/agent.go
+++ b/pkg/cli/agent/agent.go
@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"runtime"
@@ -73,7 +72,7 @@ func Run(ctx *cli.Context) error {
 	cfg.Debug = ctx.GlobalBool("debug")
 	cfg.DataDir = dataDir
 
-	contextCtx := signals.SetupSignalHandler(context.Background())
+	contextCtx := signals.SetupSignalContext()
 
 	return agent.Run(contextCtx, cfg)
 }
diff --git a/pkg/cli/etcdsnapshot/etcd_snapshot.go b/pkg/cli/etcdsnapshot/etcd_snapshot.go
index 3dd058456b..dc706c7261 100644
--- a/pkg/cli/etcdsnapshot/etcd_snapshot.go
+++ b/pkg/cli/etcdsnapshot/etcd_snapshot.go
@@ -1,7 +1,6 @@
 package etcdsnapshot
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -82,7 +81,7 @@ func run(app *cli.Context, cfg *cmds.Server) error {
 	serverConfig.ControlConfig.Runtime.ClientETCDKey = filepath.Join(dataDir, "tls", "etcd", "client.key")
 	serverConfig.ControlConfig.Runtime.KubeConfigAdmin = filepath.Join(dataDir, "cred", "admin.kubeconfig")
 
-	ctx := signals.SetupSignalHandler(context.Background())
+	ctx := signals.SetupSignalContext()
 	e := etcd.NewETCD()
 	e.SetControlConfig(&serverConfig.ControlConfig)
 
@@ -132,7 +131,7 @@ func delete(app *cli.Context, cfg *cmds.Server) error {
 	serverConfig.ControlConfig.DataDir = dataDir
 	serverConfig.ControlConfig.Runtime.KubeConfigAdmin = filepath.Join(dataDir, "cred", "admin.kubeconfig")
 
-	ctx := signals.SetupSignalHandler(context.Background())
+	ctx := signals.SetupSignalContext()
 	e := etcd.NewETCD()
 	e.SetControlConfig(&serverConfig.ControlConfig)
 
@@ -162,7 +161,7 @@ func list(app *cli.Context, cfg *cmds.Server) error {
 
 	serverConfig.ControlConfig.DataDir = dataDir
 
-	ctx := signals.SetupSignalHandler(context.Background())
+	ctx := signals.SetupSignalContext()
 	e := etcd.NewETCD()
 	e.SetControlConfig(&serverConfig.ControlConfig)
 
@@ -203,7 +202,7 @@ func prune(app *cli.Context, cfg *cmds.Server) error {
 	serverConfig.ControlConfig.DataDir = dataDir
 	serverConfig.ControlConfig.EtcdSnapshotRetention = cfg.EtcdSnapshotRetention
 
-	ctx := signals.SetupSignalHandler(context.Background())
+	ctx := signals.SetupSignalContext()
 	e := etcd.NewETCD()
 	e.SetControlConfig(&serverConfig.ControlConfig)
 
diff --git a/pkg/cli/server/server.go b/pkg/cli/server/server.go
index fc418aae57..843fb09c33 100644
--- a/pkg/cli/server/server.go
+++ b/pkg/cli/server/server.go
@@ -408,7 +408,7 @@ func run(app *cli.Context, cfg *cmds.Server, leaderControllers server.CustomCont
 
 	notifySocket := os.Getenv("NOTIFY_SOCKET")
 
-	ctx := signals.SetupSignalHandler(context.Background())
+	ctx := signals.SetupSignalContext()
 
 	if err := server.StartServer(ctx, &serverConfig, cfg); err != nil {
 		return err
diff --git a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_apply.go b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_apply.go
index 7f335530b4..b478f12c3c 100644
--- a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_apply.go
+++ b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_apply.go
@@ -30,6 +30,7 @@ const (
 	LabelNamespace = "objectset.rio.cattle.io/owner-namespace"
 	LabelHash      = "objectset.rio.cattle.io/hash"
 	LabelPrefix    = "objectset.rio.cattle.io/"
+	LabelPrune     = "objectset.rio.cattle.io/prune"
 )
 
 var (
diff --git a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_compare.go b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_compare.go
index f59628ced1..15abe6dc97 100644
--- a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_compare.go
+++ b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_compare.go
@@ -207,8 +207,7 @@ func applyPatch(gvk schema.GroupVersionKind, reconciler Reconciler, patcher Patc
 		return false, nil
 	}
 
-	logrus.Debugf("DesiredSet - Patch %s %s/%s for %s -- [%s, %s, %s, %s]", gvk, oldMetadata.GetNamespace(), oldMetadata.GetName(), debugID, patch, original, modified, current)
-
+	logrus.Debugf("DesiredSet - Patch %s %s/%s for %s -- [PATCH:%s, ORIGINAL:%s, MODIFIED:%s, CURRENT:%s]", gvk, oldMetadata.GetNamespace(), oldMetadata.GetName(), debugID, patch, original, modified, current)
 	if reconciler != nil {
 		newObject, err := prepareObjectForCreate(gvk, newObject)
 		if err != nil {
diff --git a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_process.go b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_process.go
index d559b710cf..2386c8a089 100644
--- a/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_process.go
+++ b/vendor/github.com/rancher/wrangler/pkg/apply/desiredset_process.go
@@ -382,6 +382,14 @@ func (o *desiredSet) list(namespaced bool, informer cache.SharedIndexInformer, c
 	return objs, merr.NewErrors(errs...)
 }
 
+func shouldPrune(obj runtime.Object) bool {
+	meta, err := meta.Accessor(obj)
+	if err != nil {
+		return true
+	}
+	return meta.GetLabels()[LabelPrune] != "false"
+}
+
 func compareSets(existingSet, newSet map[objectset.ObjectKey]runtime.Object) (toCreate, toDelete, toUpdate []objectset.ObjectKey) {
 	for k := range newSet {
 		if _, ok := existingSet[k]; ok {
@@ -391,9 +399,11 @@ func compareSets(existingSet, newSet map[objectset.ObjectKey]runtime.Object) (to
 		}
 	}
 
-	for k := range existingSet {
+	for k, obj := range existingSet {
 		if _, ok := newSet[k]; !ok {
-			toDelete = append(toDelete, k)
+			if shouldPrune(obj) {
+				toDelete = append(toDelete, k)
+			}
 		}
 	}
 
diff --git a/vendor/github.com/rancher/wrangler/pkg/signals/signal.go b/vendor/github.com/rancher/wrangler/pkg/signals/signal.go
index 801877ede4..ccbdabe759 100644
--- a/vendor/github.com/rancher/wrangler/pkg/signals/signal.go
+++ b/vendor/github.com/rancher/wrangler/pkg/signals/signal.go
@@ -1,12 +1,9 @@
 /*
 Copyright 2017 The Kubernetes Authors.
-
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
-
     http://www.apache.org/licenses/LICENSE-2.0
-
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -23,22 +20,47 @@ import (
 )
 
 var onlyOneSignalHandler = make(chan struct{})
+var shutdownHandler chan os.Signal
 
 // SetupSignalHandler registered for SIGTERM and SIGINT. A stop channel is returned
 // which is closed on one of these signals. If a second signal is caught, the program
 // is terminated with exit code 1.
-func SetupSignalHandler(parent context.Context) context.Context {
-	close(onlyOneSignalHandler) // panics when called twice
-	ctx, cancel := context.WithCancel(parent)
+// Only one of SetupSignalContext and SetupSignalHandler should be called, and only can
+// be called once.
+func SetupSignalHandler() <-chan struct{} {
+	return SetupSignalContext().Done()
+}
 
-	c := make(chan os.Signal, 2)
-	signal.Notify(c, shutdownSignals...)
+// SetupSignalContext is same as SetupSignalHandler, but a context.Context is returned.
+// Only one of SetupSignalContext and SetupSignalHandler should be called, and only can
+// be called once.
+func SetupSignalContext() context.Context {
+	close(onlyOneSignalHandler) // panics when called twice
+
+	shutdownHandler = make(chan os.Signal, 2)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	signal.Notify(shutdownHandler, shutdownSignals...)
 	go func() {
-		<-c
+		<-shutdownHandler
 		cancel()
-		<-c
+		<-shutdownHandler
 		os.Exit(1) // second signal. Exit directly.
 	}()
 
 	return ctx
 }
+
+// RequestShutdown emulates a received event that is considered as shutdown signal (SIGTERM/SIGINT)
+// This returns whether a handler was notified
+func RequestShutdown() bool {
+	if shutdownHandler != nil {
+		select {
+		case shutdownHandler <- shutdownSignals[0]:
+			return true
+		default:
+		}
+	}
+
+	return false
+}
\ No newline at end of file
diff --git a/vendor/modules.txt b/vendor/modules.txt
index a8a6e51058..3b6d75fb1a 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -996,7 +996,7 @@ github.com/rancher/remotedialer
 # github.com/rancher/wharfie v0.3.4
 ## explicit
 github.com/rancher/wharfie/pkg/registries
-# github.com/rancher/wrangler v0.8.3 => github.com/rancher/wrangler v0.8.5
+# github.com/rancher/wrangler v0.8.8
 ## explicit
 github.com/rancher/wrangler/pkg/apply
 github.com/rancher/wrangler/pkg/apply/injectors
@@ -3411,7 +3411,6 @@ sigs.k8s.io/yaml
 # github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.2
 # github.com/opencontainers/runtime-spec => github.com/opencontainers/runtime-spec v1.0.3-0.20210316141917-a8c4a9ee0f6b
 # github.com/rancher/k3s/pkg/data => ./pkg/data
-# github.com/rancher/wrangler => github.com/rancher/wrangler v0.8.5
 # go.etcd.io/etcd/api/v3 => github.com/k3s-io/etcd/api/v3 v3.5.0-k3s2
 # go.etcd.io/etcd/client/v3 => github.com/k3s-io/etcd/client/v3 v3.5.0-k3s2
 # go.etcd.io/etcd/etcdutl/v3 => github.com/k3s-io/etcd/etcdutl/v3 v3.5.0-k3s2