% for user, config in sorted(node.metadata['users'].items()):
%   if config.get('is_admin', False):
${user} ALL=(ALL) NOPASSWD:ALL
%   else:
%     for p in sorted(config.get('sudo_commands', [])):
${user} ALL=(ALL) NOPASSWD:${p}
%     endfor
%   endif
% endfor