We still officially doc:

$ oc adm release extract -a ${​LOCAL_SECRET_JSON} --command=openshift-install "${​LOCAL_REGISTRY}/${​LOCAL_REPOSITORY}:${​OCP_RELEASE}"

for folks installing in restricted-networks. I'm optimistic that folks could actually use the stock installer binary and imageContentSources in their install-config, without having to extract a new installer. I had a stab at CI coverage for this back in in release#5567 , but it recently rotted closed, and I haven't had time to get back to it. We should revive the effort to get this covered in CI, because if we can drop the extraction, it makes life simpler for folks on restricted networks.