Add bubblewrap for zuul-executor

The zuul-executor used bubblewrap for isolation of ansible-playbook.
Add it into windmill for now, but we really should make this an
ansible-role.

Change-Id: I9a459b5a073052e85fcd80bebd142db1bc217593
Signed-off-by: Paul Belanger <pabelanger@redhat.com>

playbooks/zuul-executor.yaml

@@ -20,6 +20,23 @@
       include_role:
         name: openstack.zuul
 
+    # TODO(pabelanger): If we want to support xenial, we'll need to use this ppa
+    # since bubblewrap doesn't exist.
+    - name: Add openstack-infra PPA for bubblewrap
+      become: yes
+      apt_repository:
+        repo: ppa:openstack-ci-core/bubblewrap
+      when:
+        - ansible_distribution_release | lower == "xenial"
+
+    # TODO(pabelanger): I'm thinking we should likely create
+    # ansible-role-bubblewrap to allow user to better manage this dependency.
+    - name: Ensure bubblewrap is installed.
+      become: yes
+      package:
+        name: bubblewrap
+        state: installed
+
     - name: Setup openstack.logrotate role.
       include_role:
         name: openstack.logrotate