documentation/docs/admin-guide/configuration/access/sudo.md

Custom sudo Rules

Custom sudo rules can be specify in hiera as follows:

aaa::sudo_rules:
   - 'Defaults:telegraf !requiretty, !syslog'
   - 'telegraf ALL=(root) NOPASSWD: /usr/lib/telegraf/scripts/nxserver_report.sh'

If the rules should be grouped in separate files in /etc/sudoers.d, you can use the following syntax:

aaa::sudoersd:
  sysctl_drop_caches:
    - "Defaults:testuser !requiretty"
    - "testuser ALL=(root) NOPASSWD: /usr/sbin/sysctl -w vm.drop_caches=1"
    - "testuser ALL=(root) NOPASSWD: /usr/sbin/sysctl -w vm.drop_caches=3"

This will create a file /etc/sudoers.d/sysctl_drop_caches with the specified content.

Beside that you might also simply deploy a file to /etc/sudoers.d e.g. via a technique described in Distribute Files.