% for user, config in sorted(node.metadata['users'].items()):
%  for p in sorted(config.get('sudo_commands', [])):
${user} ALL=(ALL) NOPASSWD:${p}
%  endfor
% endfor