fix k8s version number

note admission control docs
note encryption-provider-config flag

content/rancher/v2.x/en/security/benchmark-2.2/_index.md

@@ -1230,7 +1230,7 @@ docker inspect etcd | jq -e '.[0].Args[] | match("--peer-auto-tls(?:(?!=false).*
 
 **Notes**
 
-RKE does not currently implement a seperate CA for etcd certificates.
+RKE does not currently implement a separate CA for etcd certificates. This could be remediated by managing an external etcd cluster.
 
 `--trusted-ca-file` is set and different from the `--client-ca-file` used by `kube-apiserver`.
 

content/rancher/v2.x/en/security/hardening-2.2/_index.md

@@ -3,7 +3,7 @@ title: Hardening Guide - Rancher v2.2.x
 weight: 100
 ---
 
-### Hardening Guide for Rancher 2.2.x with Kubernetes 1.11
+### Hardening Guide for Rancher 2.2.x with Kubernetes 1.13
 
 @TODO generate PDF of this document
 [Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.2.x/Rancher_Hardening_Guide.pdf)
@@ -98,6 +98,8 @@ kernel.panic_on_oops=1
 
 Create a Kubernetes encryption configuration file on each of the RKE nodes that will be provisioned with the `controlplane` role:
 
+**NOTE:** The `--experimental-encryption-provider-config` flag in Kubernetes 1.13+ is actually `--encryption-provider-config`
+
 **Rationale**
 
 This configuration file will ensure that the Rancher RKE cluster encrypts secrets at rest, which Kubernetes does not do by default.
@@ -401,6 +403,11 @@ rke up --config cluster.yml
 
 Ensure the RKE configuration is set to deploy the `kube-api` service with the options required for controls.
 
+**NOTE:**
+
+Enabling the `AlwaysPullImages` admission control plugin can cause degraded performance due to overhead of always pulling images.
+Enabling the `DenyEscalatingExec` admission control plugin will prevent the 'Launch kubectl' functionality in the UI from working.
+
 **Rationale**
 
 To pass the following controls for the kube-api server ensure RKE configuration passes the appropriate options.