Proposal: Isolate kubelet from etcd

Discusses the current security risks posed by the kubelet->etcd pattern
and discusses some options.

Triggered by #846 and referenced in #859

Does not have to be merged, for discussion and review
I'm in favor of the result.  I can't help but feel that etcd will need to solve this ANYWAY and the idea that we're both going to arrive at very similar results is somewhat annoying.  I mean, etcd *is* an API, just a bit lower level.  Can that be fixed with less net work?