Proposal: Isolate kubelet from etcd

Discusses the current security risks posed by the kubelet->etcd pattern
and discusses some options.

Triggered by #846 and referenced in #859

Does not have to be merged, for discussion and review
I'm in favor of this approach well.  @jbeda and I were just suggesting migrating to watch on top of the API server today in a different context.