Use service-specific oauth2-proxy instances

roles/service/meta/argument_specs.yaml

@@ -36,7 +36,6 @@ argument_specs:
       service_proxy_auth_type:
         description: >-
           Set to oauth2-proxy to use OAuth2 Proxy for vhost authentication.
-          The oauth2-proxy role must be run separately.
         type: str
         required: false
         default: none
@@ -49,6 +48,20 @@ argument_specs:
         required: false
         default: []
 
+      service_oauth2_proxy_issuer_url:
+        description: >-
+          OpenID Connect issuer URL. Required if service_proxy_auth_type is oauth2-proxy.
+        type: str
+        required: false
+      oauth2_proxy_client_id:
+        description: OAuth client ID. Required if service_proxy_auth_type is oauth2-proxy.
+        type: str
+        required: false
+      oauth2_proxy_client_secret:
+        description: OAuth client secret. Required if service_proxy_auth_type is oauth2-proxy.
+        type: str
+        required: false
+
       service_container_image:
         description: "The image to run in the service container(s), in FQIN format (registry/imagename:tag)."
         type: str