SIP Related Note - munki/createOSXinstallPkg GitHub Wiki

Performing Protected Actions During Upgrade

A distribution payload-free package can run inside the OS X installation environment while the install/upgrade occurs as described in the readme. One function this allows is using csrutil to configure "safe" Netboot Server IPs if computers are regularly re-imaged across subnets.

More information on the necessity of this setting and further background can be found here.