Etcd-based auth makes every call to etcd very slow (introduces a 0.1+ s lag on every authenticated call, and some on unauthenticated calls) and in general is not that reliable as an instrument of write control.

So what we should do is the following:

• Create an nginx proxy that allows all GET requests, and for POST, PUT and DELETEs requires HTTP basic auth depending on some simple ACLs we could generate from the same rules we apply to etcd
• Verify that reads can go through with particular attention to watch timeouts.
• Progressively migrate all applications to use nginx
• Disable etcd auth
• firewall direct contact with etcd off to limit it to localhost (possibly the rest of the etcd cluster)