Best Practices for configuration management with cn=config?