Allow configurable Kubelet net image for isolated networks

Public access to the DockerHub is not guaranteed in all environments, add a flag to the kubelet that allows it to use a different image (like one on a private registry) as well as only pull the first time the image is needed.

Fixes #1545
I was mostly thinking that as soon as we have TTL this problem gets solved.

----- Original Message -----
> >  		Ports: ports,
> >  	}
> > -	if err := kl.dockerPuller.Pull(networkContainerImage); err != nil {
> > +	ok, err := kl.dockerPuller.IsImagePresent(container.Image)
> 
> I don't like that this will never try to update 'pause' - are we just
> assuming that this will become one more out-of-band operations?  or that one
> day we will distribute kubelet config somehow and the ID of the correct
> pause image will be part of that? or?
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/GoogleCloudPlatform/kubernetes/pull/1546/files#r18362079