cloak: port to new config_ops framework