Note: Zuul doesn't have the ability to use passphrases with any of the ssh keys it uses (for nodepool, or gerrit).

I believe that, in general, radosgw can support the swift object expiration header, but I don't know if support for that needs to be explicitly enabled, or what details may be relevant for the WMF instance.

Recommendations for setting up containers:

Zuul will reconnect automatically; no intervention should be required. If Zuul happens to be writing to it at the time, it will retry for about 15 seconds, and if that fails, it will give up and continue. That may mean that we end up with incomplete data in the database (so we may miss build result information). If that's critical, then users may need to manually retrigger a build. But otherwise, Zuul will continue and recover and future builds should be fine.