Defaults timestamp_timeout=5
Defaults insults
Defaults passwd_timeout=10
Defaults env_reset
Defaults secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

root ALL=(ALL) ALL

% for user in sorted(node.metadata['sudo']):
${user} ALL=(ALL) NOPASSWD:ALL
% endfor