From 7a99e7c8346f44cd6aa9ff0e6b72f71aa1a39cc9 Mon Sep 17 00:00:00 2001
From: Ashley Davis <ashley.davis@jetstack.io>
Date: Fri, 22 Oct 2021 18:55:47 +0100
Subject: [PATCH 1/3] add script for writing make variables for base images

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
---
 hack/latest_base_images.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100755 hack/latest_base_images.sh

diff --git a/hack/latest_base_images.sh b/hack/latest_base_images.sh
new file mode 100755
index 000000000..580c45412
--- /dev/null
+++ b/hack/latest_base_images.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -eu -o pipefail
+
+TARGET=make/base_images.mk
+
+STATIC_BASE=gcr.io/distroless/static
+DYNAMIC_BASE=gcr.io/distroless/base
+
+mkdir -p make
+
+echo "# autogenerated by hack/latest_base_images.sh" > $TARGET
+
+echo "STATIC_BASE_IMAGE_amd64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-amd64)" >> $TARGET
+echo "STATIC_BASE_IMAGE_arm64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-arm64)" >> $TARGET
+echo "STATIC_BASE_IMAGE_s390x := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-s390x)" >> $TARGET
+echo "STATIC_BASE_IMAGE_arm   := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-arm)" >> $TARGET
+echo "STATIC_BASE_IMAGE_ppc64le := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-ppc64le)" >> $TARGET
+
+echo "DYNAMIC_BASE_IMAGE_amd64 := $DYNAMIC_BASE@$(crane digest $DYNAMIC_BASE:latest-amd64)" >> $TARGET
+echo "DYNAMIC_BASE_IMAGE_arm64 := $DYNAMIC_BASE@$(crane digest $DYNAMIC_BASE:latest-arm64)" >> $TARGET
+echo "DYNAMIC_BASE_IMAGE_s390x := $DYNAMIC_BASE@$(crane digest $DYNAMIC_BASE:latest-s390x)" >> $TARGET
+echo "DYNAMIC_BASE_IMAGE_arm   := $DYNAMIC_BASE@$(crane digest $DYNAMIC_BASE:latest-arm)" >> $TARGET
+echo "DYNAMIC_BASE_IMAGE_ppc64le := $DYNAMIC_BASE@$(crane digest $DYNAMIC_BASE:latest-ppc64le)" >> $TARGET

From 6734e9b7469288b51848eb209597a1920e4801ea Mon Sep 17 00:00:00 2001
From: Ashley Davis <ashley.davis@jetstack.io>
Date: Tue, 30 Nov 2021 17:25:26 +0000
Subject: [PATCH 2/3] add scripts for sha256 sum calculations

hash.sh returns just the sha256sum of its input file

checkhash.sh uses ha.sh to get the sha256sum of its first argument and
then validates that the checksum matches the value provided in its
second argument

hash.sh isn't currently fully portable since sha256sum isn't present
by default on macOS, but it provides a single point around which we can
do hashing to validate checksums

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
---
 hack/util/checkhash.sh | 27 +++++++++++++++++++++++++++
 hack/util/hash.sh      | 22 ++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100755 hack/util/checkhash.sh
 create mode 100755 hack/util/hash.sh

diff --git a/hack/util/checkhash.sh b/hack/util/checkhash.sh
new file mode 100755
index 000000000..bd01194ad
--- /dev/null
+++ b/hack/util/checkhash.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu -o pipefail
+
+# This script takes the hash of its first argument and verifies it against the
+# hex hash given in its second argument
+
+SHASUM=$(./hack/util/hash.sh "$1")
+
+if [ $SHASUM != "$2"  ]; then
+	echo "invalid checksum for \"$1\": wanted \"$2\" but got \"$SHASUM\""
+	exit 1
+fi
diff --git a/hack/util/hash.sh b/hack/util/hash.sh
new file mode 100755
index 000000000..63add1009
--- /dev/null
+++ b/hack/util/hash.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu -o pipefail
+
+# This script is a wrapper for outputting purely the sha256 hash of the input file,
+# ideally in a portable way.
+
+sha256sum $1 | cut -d" " -f1

From 32d716654a1091e99e80c10a2798cd839a705713 Mon Sep 17 00:00:00 2001
From: Ashley Davis <ashley.davis@jetstack.io>
Date: Thu, 21 Oct 2021 18:18:07 +0100
Subject: [PATCH 3/3] Add a makefile flow for building artifacts

Includes targets for:

- all "server" binaries, for all arches
- all containers for all server binaries for all arches
- all client binaries (kubectl plugin / cmctl) for all arches
- the cert-manager helm chart + signature
- the cert-manager static manifests + CRDs
- tools which bazel would download, with checksum verification
- (commented out) a signed SHA256SUM file for client binaries

Upgrades from the bazel flow include that:

- we use OS-specific base images rather than just using amd64 everywhere
- we easily add support for signing artifacts at build time
- we add ".exe" to the end of windows executables
- we add a zip file for windows executables, for easier consumption
- we concatenate YAML files more robustly
- staging a full release should be much faster
- hopefully, it's easier to change things!
- licenses are trimmed down to reduce bloat in images (the license
  bundle was 1.4MB in size alone)

Changes from the bazel flow include:

- containers no longer have a symlink to the binary at an unusual
  path, but instead just have the binary at a more predictable path
  (e.g. /app/cmd/webhook/webhook instead of
  /app/cmd/webhook/webhook.runfiles/com_github_jetstack_cert_manager/cmd/webhook/webhook_/webhook)

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
---
 .dockerignore                                 |   7 +
 .gitignore                                    |   1 +
 .../cert-manager/signkey_annotation.txt       |   2 +
 deploy/manifests/namespace.yaml               |   4 +
 hack/artifact-metadata.template.json          |   6 +
 hack/concat-yaml.sh                           |  43 ++++
 hack/containers/Containerfile.acmesolver      |  16 ++
 hack/containers/Containerfile.cainjector      |  16 ++
 hack/containers/Containerfile.controller      |  16 ++
 hack/containers/Containerfile.ctl             |  16 ++
 hack/containers/Containerfile.webhook         |  16 ++
 ...t_base_images.sh => latest-base-images.sh} |  22 +-
 make/Makefile                                 | 107 +++++++++
 make/base_images.mk                           |  11 +
 make/cmctl.mk                                 | 221 ++++++++++++++++++
 make/containers.mk                            | 118 ++++++++++
 make/git.mk                                   |  14 ++
 make/licenses.mk                              |  23 ++
 make/manifests.mk                             | 168 +++++++++++++
 make/release_containers.mk                    |  37 +++
 make/server.mk                                |  77 ++++++
 make/tools.mk                                 | 142 +++++++++++
 22 files changed, 1082 insertions(+), 1 deletion(-)
 create mode 100644 .dockerignore
 create mode 100644 deploy/charts/cert-manager/signkey_annotation.txt
 create mode 100644 deploy/manifests/namespace.yaml
 create mode 100644 hack/artifact-metadata.template.json
 create mode 100755 hack/concat-yaml.sh
 create mode 100644 hack/containers/Containerfile.acmesolver
 create mode 100644 hack/containers/Containerfile.cainjector
 create mode 100644 hack/containers/Containerfile.controller
 create mode 100644 hack/containers/Containerfile.ctl
 create mode 100644 hack/containers/Containerfile.webhook
 rename hack/{latest_base_images.sh => latest-base-images.sh} (53%)
 create mode 100644 make/Makefile
 create mode 100644 make/base_images.mk
 create mode 100644 make/cmctl.mk
 create mode 100644 make/containers.mk
 create mode 100644 make/git.mk
 create mode 100644 make/licenses.mk
 create mode 100644 make/manifests.mk
 create mode 100644 make/release_containers.mk
 create mode 100644 make/server.mk
 create mode 100644 make/tools.mk

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..f99145275
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+bin/*
+bazel*
+
+!bin/server/**
+!bin/cmctl/cmctl-linux-*
+!bin/scratch/cert-manager.license
+!bin/scratch/cert-manager.licenses_notice
diff --git a/.gitignore b/.gitignore
index bde702fda..d4f55b169 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@ bazel-*
 /.project
 _artifacts/
 /vendor/
+bin/
diff --git a/deploy/charts/cert-manager/signkey_annotation.txt b/deploy/charts/cert-manager/signkey_annotation.txt
new file mode 100644
index 000000000..13f5c8cd1
--- /dev/null
+++ b/deploy/charts/cert-manager/signkey_annotation.txt
@@ -0,0 +1,2 @@
+fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
+url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
diff --git a/deploy/manifests/namespace.yaml b/deploy/manifests/namespace.yaml
new file mode 100644
index 000000000..c90416ff4
--- /dev/null
+++ b/deploy/manifests/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
diff --git a/hack/artifact-metadata.template.json b/hack/artifact-metadata.template.json
new file mode 100644
index 000000000..aa104d2e8
--- /dev/null
+++ b/hack/artifact-metadata.template.json
@@ -0,0 +1,6 @@
+{
+	"name": "TODO",
+	"sha256": "TODO",
+	"os": "TODO",
+	"architecture": "TODO"
+}
diff --git a/hack/concat-yaml.sh b/hack/concat-yaml.sh
new file mode 100755
index 000000000..7dee521c5
--- /dev/null
+++ b/hack/concat-yaml.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu -o pipefail
+
+while (($#)); do
+	f=$1
+	if [[ ! -f "$f" ]]; then
+		echo "$f doesn't exist, exiting" 1>&2
+		exit 1
+	fi
+
+	# The YAML spec requires that a YAML directive only appears once in a document
+	# We probably won't have any directives, so we just check for any directive and
+	# fail if there's one in any of the files
+	# https://yaml.org/spec/1.2.2/#681-yaml-directives
+	if grep -q "%YAML" $f; then
+		echo "found %YAML directive in file; this can't be handled safely by this script" 1>&2
+		exit 1
+	fi
+
+	cat $f
+
+	shift
+
+	# if there's at least one more file left, output the YAML file separator
+	if [[ $# -gt 0 ]]; then
+		echo "---"
+	fi
+done
diff --git a/hack/containers/Containerfile.acmesolver b/hack/containers/Containerfile.acmesolver
new file mode 100644
index 000000000..64d8d280a
--- /dev/null
+++ b/hack/containers/Containerfile.acmesolver
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/acmesolver/acmesolver
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/acmesolver/acmesolver"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.cainjector b/hack/containers/Containerfile.cainjector
new file mode 100644
index 000000000..31a2ba2b3
--- /dev/null
+++ b/hack/containers/Containerfile.cainjector
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/cainjector/cainjector
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/cainjector/cainjector"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.controller b/hack/containers/Containerfile.controller
new file mode 100644
index 000000000..f64d7e825
--- /dev/null
+++ b/hack/containers/Containerfile.controller
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/controller/controller
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/controller/controller"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.ctl b/hack/containers/Containerfile.ctl
new file mode 100644
index 000000000..6618ca759
--- /dev/null
+++ b/hack/containers/Containerfile.ctl
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/ctl/ctl
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/ctl/ctl"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.webhook b/hack/containers/Containerfile.webhook
new file mode 100644
index 000000000..91a797093
--- /dev/null
+++ b/hack/containers/Containerfile.webhook
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/webhook/webhook
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/webhook/webhook"]
+
+# vim: syntax=dockerfile
diff --git a/hack/latest_base_images.sh b/hack/latest-base-images.sh
similarity index 53%
rename from hack/latest_base_images.sh
rename to hack/latest-base-images.sh
index 580c45412..6fb12c6aa 100755
--- a/hack/latest_base_images.sh
+++ b/hack/latest-base-images.sh
@@ -1,7 +1,27 @@
 #!/usr/bin/env bash
 
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 set -eu -o pipefail
 
+# This script fetches the latest sha256 digest of each base image for each architecture we support on servers
+# and writes those hashes to Makefile-formatted variables for use in Makefiles.
+
+# This in turn allows us to easily update all base images to their latest versions, while mantaining the use
+# of digests rather than tags when we refer to these base images.
+
 TARGET=make/base_images.mk
 
 STATIC_BASE=gcr.io/distroless/static
@@ -9,7 +29,7 @@ DYNAMIC_BASE=gcr.io/distroless/base
 
 mkdir -p make
 
-echo "# autogenerated by hack/latest_base_images.sh" > $TARGET
+echo "# autogenerated by hack/latest-base-images.sh" > $TARGET
 
 echo "STATIC_BASE_IMAGE_amd64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-amd64)" >> $TARGET
 echo "STATIC_BASE_IMAGE_arm64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-arm64)" >> $TARGET
diff --git a/make/Makefile b/make/Makefile
new file mode 100644
index 000000000..56624f84f
--- /dev/null
+++ b/make/Makefile
@@ -0,0 +1,107 @@
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SHELL := /usr/bin/env bash
+.SHELLFLAGS := -uo pipefail -c
+
+SOURCES := $(shell find . -type f -name "*.go")
+
+GOFLAGS := -ldflags '-w -s' -trimpath
+
+# GOBUILDPROCS is passed to GOMAXPROCS when running go build; if you're running make in parallel
+# using "-jN" then you'll probably want to reduce the value of GOBUILDPROCS or else you could end
+# up running N parallel invocations of go build, each of which will spin up as many threads as are
+# available on your system.
+GOBUILDPROCS ?=
+
+# Set this as an environment variable to enable signing commands using cmrel
+# Format should be:
+# projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/cryptoKeyVersions/<keyversion>
+CMREL_KEY ?= ""
+
+HOST_OS = $(shell $(GO) env GOOS)
+HOST_ARCH = $(shell $(GO) env GOARCH)
+
+include make/git.mk
+include make/tools.mk
+include make/base_images.mk
+include make/cmctl.mk
+include make/server.mk
+include make/containers.mk
+include make/release_containers.mk
+include make/manifests.mk
+include make/licenses.mk
+
+.PHONY: all
+all: binaries helm-chart static-manifests all-containers  ## Build all artifacts which might be run or used locally, except for anything signed.
+
+.PHONY: all-signed
+all-signed: all  ## Build `all` followed by signed artifacts which require a key to be configured.
+	$(MAKE) -f make/Makefile signed-artifacts
+
+.PHONY: binaries
+binaries: server-binaries cmctl kubectl-cert_manager ## Build all binaries for all server and client platforms
+
+.PHONY: signed-artifacts
+signed-artifacts: helm-chart-signature  ## Shorthand to create all artifacts which can be signed (and which therefore require signing keys to be configured)
+
+.PHONY: staged-release
+staged-release: all-signed release-manifests release-containers ## Creates a full release ready to be staged, including containers bundled for distribution. Requires signing keys to be configured.
+	$(MAKE) -f make/Makefile bin/release/metadata.json
+
+# Takes all metadata files in bin/metadata and combines them into one
+bin/release/metadata.json: $(wildcard bin/metadata/*.json) | bin/release
+	jq -n \
+		--arg releaseVersion "$(RELEASE_VERSION)" \
+		--arg gitCommitRef "$(GITCOMMIT)" \
+		'.releaseVersion = $$releaseVersion | .gitCommitRef = $$gitCommitRef | .artifacts += [inputs]' $^ > $@
+
+.PHONY: clean
+clean:  ## Remove the bin directory, cleaning all built artifacts and locally installed tools
+	rm -rf bin
+
+bin:
+	@mkdir -p $@
+
+bin/scratch:
+	@mkdir -p $@
+
+bin/release:
+	@mkdir -p $@
+
+bin/metadata:
+	@mkdir -p $@
+
+# Set this as an environment variable to enable signing commands using cosign
+# Format should be any accepted by cosign; for GCP, use:
+# gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/versions/<keyversion>
+# CMREL_KEY ?= ""
+# Example of how we can generate a SHA256SUMS file and sign it using cosign
+#bin/SHA256SUMS: $(wildcard ...)
+#	@# The patsubst means "all dependencies, but with "bin/" trimmed off the beginning
+#	@# We cd into bin so that SHA256SUMS file doesn't have a prefix of `bin` on everything
+#	cd $(dir $@) && sha256sum $(patsubst bin/%,%,$^) > $(notdir $@)
+#
+#bin/SHA256SUMS.sig: bin/SHA256SUMS | bin/tools/cosign
+#	$(COSIGN) sign-blob --key $(COSIGN_KEY) $< > $@
+
+# This target allows us to set all the modified times for all files in bin to the same time, which
+# is similar to what bazel does. We might not want this, and it's not currently used.
+.PHONY: forcetime
+forcetime: | bin
+	find bin | xargs touch -d "2000-01-01 00:00:00" -
+
+.PHONY: help
+help: ## Display this help.
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
diff --git a/make/base_images.mk b/make/base_images.mk
new file mode 100644
index 000000000..b85c075ab
--- /dev/null
+++ b/make/base_images.mk
@@ -0,0 +1,11 @@
+# autogenerated by hack/latest-base-images.sh
+STATIC_BASE_IMAGE_amd64 := gcr.io/distroless/static@sha256:a5635fa9dda1cf81666d8c288130bf3519bdeab1b7ed717db496a73d25d1b35c
+STATIC_BASE_IMAGE_arm64 := gcr.io/distroless/static@sha256:cc7389ac8f818fa1af21bd9ff456987cc2d42577013ab2d02807c51378f5c036
+STATIC_BASE_IMAGE_s390x := gcr.io/distroless/static@sha256:3e60feae6e1cd2b6fe0d8e0c4d9811231e73b0ce4cf5059373d56d1de469ecc9
+STATIC_BASE_IMAGE_ppc64le := gcr.io/distroless/static@sha256:e0d91a3255efe07a17ca828eab3a9068e4757a1e86bc8d83c9a031ebda7a19ad
+STATIC_BASE_IMAGE_arm := gcr.io/distroless/static@sha256:a81c4c77b601a31c2b4a77ff9fd2aa7f80b1d542ea2d6cc0d9b056a6e6f17a0d
+DYNAMIC_BASE_IMAGE_amd64 := gcr.io/distroless/base@sha256:1a80a34cb3d7c4326191047976e4161741aef22c351932b55e32b72ce8827c27
+DYNAMIC_BASE_IMAGE_arm64 := gcr.io/distroless/base@sha256:f557575011fd640f984c56d74ca8f0708a50b3252a15db6e1a4895594c531bbf
+DYNAMIC_BASE_IMAGE_s390x := gcr.io/distroless/base@sha256:46c4936e7e3f20c9ae802d4ebf361966bd3a177e1342d566c52d4daad3e355b5
+DYNAMIC_BASE_IMAGE_ppc64le := gcr.io/distroless/base@sha256:a04ec0087837bc289056a5477fe2dc86745951dfe8419afe419426325cbb4c8f
+DYNAMIC_BASE_IMAGE_arm := gcr.io/distroless/base@sha256:4e72c245399db1a2f89d70ce2839c024ded5051d13e78d9d09b9a7c48155d1fd
diff --git a/make/cmctl.mk b/make/cmctl.mk
new file mode 100644
index 000000000..c8e5d8586
--- /dev/null
+++ b/make/cmctl.mk
@@ -0,0 +1,221 @@
+CMCTL_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=cmctl" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=true"'
+
+KUBECTL_PLUGIN_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=kubectl cert-manager" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=false"'
+
+bin/cmctl:
+	@mkdir -p $@
+
+bin/kubectl-cert_manager:
+	@mkdir -p $@
+
+.PHONY: cmctl
+cmctl: cmctl-linux cmctl-linux-tarballs cmctl-linux-metadata cmctl-darwin cmctl-darwin-tarballs cmctl-darwin-metadata cmctl-windows cmctl-windows-tarballs cmctl-windows-metadata | bin/cmctl
+
+.PHONY: cmctl-linux
+cmctl-linux: bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le bin/cmctl/cmctl-linux-arm | bin/cmctl
+
+.PHONY: cmctl-linux-tarballs
+cmctl-linux-tarballs: bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz | bin/release
+
+.PHONY: cmctl-linux-metadata
+cmctl-linux-metadata: bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json | bin/metadata
+
+bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le: bin/cmctl/cmctl-linux-%: $(SOURCES) | bin/cmctl
+	GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/cmctl/cmctl-linux-arm: $(SOURCES) | bin/cmctl
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz: bin/release/cert-manager-cmctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-linux-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: cmctl-darwin
+cmctl-darwin: bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64 | bin/cmctl
+
+.PHONY: cmctl-darwin-tarballs
+cmctl-darwin-tarballs: bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz | bin/release
+
+.PHONY: cmctl-darwin-metadata
+cmctl-darwin-metadata: bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json | bin/metadata
+
+bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64:  bin/cmctl/cmctl-darwin-%: $(SOURCES) | bin/cmctl
+	GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz: bin/release/cert-manager-cmctl-darwin-%.tar.gz:  bin/cmctl/cmctl-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "darwin" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: cmctl-windows
+cmctl-windows: bin/cmctl/cmctl-windows-amd64.exe | bin/cmctl
+
+.PHONY: cmctl-windows-tarballs
+cmctl-windows-tarballs: bin/release/cert-manager-cmctl-windows-amd64.tar.gz bin/release/cert-manager-cmctl-windows-amd64.zip | bin/release
+
+.PHONY: cmctl-windows-metadata
+cmctl-windows-metadata: bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json | bin/release
+
+bin/cmctl/cmctl-windows-amd64.exe: $(SOURCES) | bin/cmctl
+	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-windows-amd64.zip: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
+	rm -rf $(TARDIR)
+
+bin/release/cert-manager-cmctl-windows-amd64.tar.gz: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager
+kubectl-cert_manager: kubectl-cert_manager-linux kubectl-cert_manager-linux-tarballs kubectl-cert_manager-linux-metadata kubectl-cert_manager-darwin kubectl-cert_manager-darwin-tarballs kubectl-cert_manager-darwin-metadata kubectl-cert_manager-windows kubectl-cert_manager-windows-tarballs kubectl-cert_manager-windows-metadata | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-linux
+kubectl-cert_manager-linux: bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-linux-tarballs
+kubectl-cert_manager-linux-tarballs: bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz | bin/release
+
+.PHONY: kubectl-cert_manager-linux-metadata
+kubectl-cert_manager-linux-metadata: bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json | bin/metadata
+
+bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le: bin/kubectl-cert_manager/kubectl-cert_manager-linux-%: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-linux-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager-darwin
+kubectl-cert_manager-darwin: bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64 | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-darwin-tarballs
+kubectl-cert_manager-darwin-tarballs: bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz | bin/release
+
+.PHONY: kubectl-cert_manager-darwin-metadata
+kubectl-cert_manager-darwin-metadata: bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json | bin/metadata
+
+bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64:  bin/kubectl-cert_manager/kubectl-cert_manager-darwin-%: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz:  bin/kubectl-cert_manager/kubectl-cert_manager-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "darwin" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager-windows
+kubectl-cert_manager-windows: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-windows-tarballs
+kubectl-cert_manager-windows-tarballs: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip | bin/release
+
+.PHONY: kubectl-cert_manager-windows-metadata
+kubectl-cert_manager-windows-metadata: bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json | bin/release
+
+bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
+	rm -rf $(TARDIR)
+
+bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
diff --git a/make/containers.mk b/make/containers.mk
new file mode 100644
index 000000000..010069f1f
--- /dev/null
+++ b/make/containers.mk
@@ -0,0 +1,118 @@
+# set to "DYNAMIC" to use a dynamic base image
+BASE_IMAGE_TYPE:=STATIC
+
+BASE_IMAGE_controller-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_controller-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_controller-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_controller-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_controller-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_webhook-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_webhook-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_webhook-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_webhook-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_webhook-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_acmesolver-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_acmesolver-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_acmesolver-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_acmesolver-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_acmesolver-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_cainjector-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_cainjector-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_cainjector-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_cainjector-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_cainjector-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_cmctl-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_cmctl-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_cmctl-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_cmctl-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_cmctl-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+bin/containers:
+	@mkdir -p $@
+
+.PHONY: all-containers
+all-containers: cert-manager-controller-linux cert-manager-webhook-linux cert-manager-acmesolver-linux cert-manager-cainjector-linux cert-manager-ctl-linux
+
+.PHONY: cert-manager-controller-linux
+cert-manager-controller-linux: bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz
+
+bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz: bin/containers/cert-manager-controller-linux-%.tar.gz: bin/server/controller-linux-% hack/containers/Containerfile.controller bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-controller-$*:$(RELEASE_VERSION))
+	$(eval BASE := $(BASE_IMAGE_$(notdir $<)))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.controller \
+		--build-arg BASE_IMAGE=$(BASE) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-webhook-linux
+cert-manager-webhook-linux: bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz
+
+bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz: bin/containers/cert-manager-webhook-linux-%.tar.gz: bin/server/webhook-linux-% hack/containers/Containerfile.webhook bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-webhook-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.webhook \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-cainjector-linux
+cert-manager-cainjector-linux: bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz
+
+bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz: bin/containers/cert-manager-cainjector-linux-%.tar.gz: bin/server/cainjector-linux-% hack/containers/Containerfile.cainjector bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-cainjector-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.cainjector \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-acmesolver-linux
+cert-manager-acmesolver-linux: bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz
+
+bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz: bin/server/acmesolver-linux-% hack/containers/Containerfile.acmesolver bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-acmesolver-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.acmesolver \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-ctl-linux
+cert-manager-ctl-linux: bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz
+
+bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz: bin/containers/cert-manager-ctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% hack/containers/Containerfile.ctl bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-ctl-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.ctl \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
diff --git a/make/git.mk b/make/git.mk
new file mode 100644
index 000000000..270454db8
--- /dev/null
+++ b/make/git.mk
@@ -0,0 +1,14 @@
+RELEASE_VERSION := $(shell git describe --tags)
+
+GITCOMMIT := $(shell git rev-parse HEAD)
+
+IS_TAGGED_RELEASE := $(shell git describe --exact-match HEAD >/dev/null 2>&1 && echo "true" || echo "false")
+
+IS_PRERELEASE := $(shell echo $(RELEASE_VERSION) | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$$' - && echo "false" || echo "true")
+
+.PHONY: gitver
+gitver:
+	@echo "Release version:   \"$(RELEASE_VERSION)\""
+	@echo "Is tagged release: \"$(IS_TAGGED_RELEASE)\""
+	@echo "Is prerelease:     \"$(IS_PRERELEASE)\""
+	@echo "Git commit hash:   \"$(GITCOMMIT)\""
diff --git a/make/licenses.mk b/make/licenses.mk
new file mode 100644
index 000000000..5a656c604
--- /dev/null
+++ b/make/licenses.mk
@@ -0,0 +1,23 @@
+# LICENSE_YEAR is the value which will be substituted into licenses when they're generated
+# It would be possible to make this more dynamic, but there's seemingly no need:
+# https://stackoverflow.com/a/2391555/1615417
+# As such, this is hardcoded to avoid needless complexity
+LICENSE_YEAR=2021
+
+# Creates the boilerplate header for YAML files, assumed to be the same as the one in
+# shell scripts (hence the use of boilerplate.sh.txt)
+bin/scratch/license.yaml: hack/boilerplate/boilerplate.sh.txt | bin/scratch
+	sed -e "s/YEAR/$(LICENSE_YEAR)/g" < $< > $@
+
+# The references LICENSES file is 1.4MB at the time of writing. Bundling it into every container image
+# seems wasteful in terms of bytes stored and bytes transferred on the wire just to add a file
+# which presumably nobody will ever read or care about. Instead, just add a little footnote pointing
+# to the cert-manager repo in case anybody actually decides that they care.
+bin/scratch/license-footnote.yaml: | bin/scratch
+	@echo -e "# To view licenses for cert-manager dependencies, see the LICENSES file in the\n# cert-manager repo: https://github.com/jetstack/cert-manager" > $@
+
+bin/scratch/cert-manager.license: bin/scratch/license.yaml bin/scratch/license-footnote.yaml | bin/scratch
+	cat $^ > $@
+
+bin/scratch/cert-manager.licenses_notice: bin/scratch/license-footnote.yaml | bin/scratch
+	cp $< $@
diff --git a/make/manifests.mk b/make/manifests.mk
new file mode 100644
index 000000000..6bf57bae5
--- /dev/null
+++ b/make/manifests.mk
@@ -0,0 +1,168 @@
+HELM_CMD=./bin/tools/helm
+
+ALLCRDS=deploy/crds/crd-certificaterequests.yaml deploy/crds/crd-certificates.yaml deploy/crds/crd-challenges.yaml deploy/crds/crd-clusterissuers.yaml deploy/crds/crd-issuers.yaml deploy/crds/crd-orders.yaml
+
+HELM_TEMPLATE_SOURCES=$(wildcard deploy/charts/cert-manager/templates/*.yaml)
+HELM_TEMPLATE_TARGETS=$(patsubst deploy/charts/cert-manager/templates/%,bin/helm/cert-manager/templates/%,$(HELM_TEMPLATE_SOURCES))
+
+####################
+# Friendly Targets #
+####################
+
+# These targets provide friendly names for the various manifests / charts we build
+
+.PHONY: helm-chart
+helm-chart: bin/cert-manager-$(RELEASE_VERSION).tgz
+
+.PHONY: helm-chart-signature
+helm-chart-signature: bin/cert-manager-$(RELEASE_VERSION).tgz.prov
+
+.PHONY: static-manifests
+static-manifests: bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml
+
+###################
+# Release Targets #
+###################
+
+.PHONY: release-manifests
+release-manifests: bin/release/cert-manager-manifests.tar.gz bin/metadata/cert-manager-manifests.tar.gz.metadata.json
+
+bin/release/cert-manager-manifests.tar.gz: bin/cert-manager-$(RELEASE_VERSION).tgz bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/cert-manager-$(RELEASE_VERSION).tgz.prov | bin/scratch/manifests bin/release
+	mkdir -p bin/scratch/manifests/deploy/chart/
+	mkdir -p bin/scratch/manifests/deploy/manifests/
+	cp bin/cert-manager-$(RELEASE_VERSION).tgz bin/cert-manager-$(RELEASE_VERSION).tgz.prov bin/scratch/manifests/deploy/chart/
+	cp bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/scratch/manifests/deploy/manifests/
+	tar czf $@ -C bin/scratch/manifests .
+	rm -rf bin/scratch/manifests
+
+# This metadata blob is constructed slightly differently and doesn't use hack/artifact-metadata.template.json directly;
+# this is because the bazel staged releases didn't include an "os" or "architecture" field for this artifact
+bin/metadata/cert-manager-manifests.tar.gz.metadata.json: bin/release/cert-manager-manifests.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq -n --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		'.name = $$name | .sha256 = $$sha256' > $@
+
+################
+# Helm Targets #
+################
+
+# These targets provide for building and signing the cert-manager helm chart.
+
+bin/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager/README.md bin/helm/cert-manager/Chart.yaml bin/helm/cert-manager/values.yaml $(HELM_TEMPLATE_TARGETS) bin/helm/cert-manager/templates/NOTES.txt bin/helm/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager bin/tools/helm
+	$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager
+
+bin/cert-manager-$(RELEASE_VERSION).tgz.prov: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/helm/cert-manager bin/tools/cmrel
+ifeq ($(strip $(CMREL_KEY)),)
+	$(error Trying to sign helm chart but CMREL_KEY is empty)
+endif
+	cd $(dir $<) && $(CMREL) sign helm --chart-path "$(notdir $<)" --key "$(CMREL_KEY)"
+
+$(HELM_TEMPLATE_TARGETS): $(HELM_TEMPLATE_SOURCES) | bin/helm/cert-manager/templates
+	cp -f $^ $(dir $@)
+
+bin/helm/cert-manager/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager/templates
+	cp $< $@
+
+bin/helm/cert-manager/templates/NOTES.txt: deploy/charts/cert-manager/templates/NOTES.txt | bin/helm/cert-manager/templates
+	cp $< $@
+
+bin/helm/cert-manager/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
+	cp $< $@
+
+bin/helm/cert-manager/README.md: deploy/charts/cert-manager/README.template.md | bin/helm/cert-manager
+	sed -e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
+
+bin/helm/cert-manager/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml deploy/charts/cert-manager/signkey_annotation.txt | bin/helm/cert-manager bin/tools/yq
+	@# this horrible mess is taken from the YQ manual's example of multiline string blocks from a file:
+	@# https://mikefarah.gitbook.io/yq/operators/string-operators#string-blocks-bash-and-newlines
+	@# we set a bash variable called SIGNKEY_ANNOTATION using read, and then use that bash variable in yq
+	IFS= read -rd '' SIGNKEY_ANNOTATION < <(cat deploy/charts/cert-manager/signkey_annotation.txt) ; \
+		SIGNKEY_ANNOTATION=$$SIGNKEY_ANNOTATION $(YQ) eval \
+		'.annotations."artifacthub.io/signKey" = strenv(SIGNKEY_ANNOTATION) | .annotations."artifacthub.io/prerelease" = "$(IS_PRERELEASE)" | .version = "$(RELEASE_VERSION)" | .appVersion = "$(RELEASE_VERSION)"' \
+		$< > $@
+
+#################################
+# Targets for cert-manager.yaml #
+#################################
+
+# These targets depend on the cert-manager helm chart and the creation of the standalone CRDs.
+# They use `helm template` to create a single static YAML manifest containing all resources
+# with templating completed, and then concatenate with the cert-manager namespace and the CRDs.
+
+bin/yaml/cert-manager.yaml: bin/scratch/license.yaml deploy/manifests/namespace.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml bin/scratch/yaml/cert-manager-static-resources.yaml | bin/yaml
+	@# NB: filter-out removes the license (the first dependency, $<) from the YAML concatenation
+	./hack/concat-yaml.sh $(filter-out $<, $^) | cat $< - > $@
+
+# Renders all resources except the namespace and the CRDs
+bin/scratch/yaml/cert-manager-static-resources.yaml: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
+	# The sed command removes the first line but only if it matches "---", which helm adds
+	$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
+		sed -e "1{/^---$$/d;}" > $@
+
+######################################
+# Targets for cert-manager.crds.yaml #
+######################################
+
+# These targets generate a dummy helm chart containing _only_ our CRDs, and then uses `helm template`
+# to create a single YAML file containing all CRDS with the templating completed
+
+# CRDs with a license
+bin/yaml/cert-manager.crds.yaml: bin/scratch/license.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml | bin/yaml
+	cat $^ > $@
+
+bin/scratch/yaml/cert-manager.crds.unlicensed.yaml: bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
+	# The sed command removes the first line but only if it matches "---", which helm adds
+	$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
+		sed -e "1{/^---$$/d;}" > $@
+
+bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager-crds/templates/_helpers.tpl bin/helm/cert-manager-crds/templates/crd-templates.yaml bin/helm/cert-manager-crds/README.md bin/helm/cert-manager-crds/Chart.yaml bin/helm/cert-manager-crds/values.yaml  | bin/scratch bin/tools/helm
+	$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager-crds
+
+# create a temporary chart containing the cert-manager CRDs in order to use helm's
+# templating engine to create usable CRDs for static installation
+bin/helm/cert-manager-crds/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml | bin/helm/cert-manager-crds
+	sed -e "s:{{IS_PRERELEASE}}:$(IS_PRERELEASE):g" \
+		-e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
+
+bin/helm/cert-manager-crds/README.md: | bin/helm/cert-manager-crds
+	@echo "This chart is a cert-manager build artifact, do not use" > $@
+
+bin/helm/cert-manager-crds/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
+	cp $< $@
+
+bin/helm/cert-manager-crds/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager-crds/templates
+	cp $< $@
+
+bin/helm/cert-manager-crds/templates/crd-templates.yaml: bin/scratch/yaml/cert-manager-crd-templates.yaml | bin/helm/cert-manager-crds/templates
+	cp $< $@
+
+# Create a single file containing all CRDs before they've been templated
+bin/scratch/yaml/cert-manager-crd-templates.yaml: $(ALLCRDS) | bin/scratch/yaml
+	./hack/concat-yaml.sh $^ > $@
+
+###############
+# Dir targets #
+###############
+
+# These targets are trivial, to ensure that dirs exist
+
+bin/yaml:
+	@mkdir -p $@
+
+bin/helm/cert-manager:
+	@mkdir -p $@
+
+bin/helm/cert-manager/templates:
+	@mkdir -p $@
+
+bin/helm/cert-manager-crds:
+	@mkdir -p $@
+
+bin/helm/cert-manager-crds/templates:
+	@mkdir -p $@
+
+bin/scratch/yaml:
+	@mkdir -p $@
+
+bin/scratch/manifests:
+	@mkdir -p $@
diff --git a/make/release_containers.mk b/make/release_containers.mk
new file mode 100644
index 000000000..fca9d806e
--- /dev/null
+++ b/make/release_containers.mk
@@ -0,0 +1,37 @@
+.PHONY: release-containers
+release-containers: release-container-bundles release-container-metadata
+
+.PHONY: release-container-bundles
+release-container-bundles: bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz
+
+bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz: bin/release/cert-manager-server-linux-%.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz bin/containers/cert-manager-cainjector-linux-%.tar.gz bin/containers/cert-manager-controller-linux-%.tar.gz bin/containers/cert-manager-webhook-linux-%.tar.gz bin/containers/cert-manager-ctl-linux-%.tar.gz bin/scratch/cert-manager.license | bin/release bin/scratch
+	@# use basename twice to strip both "tar" and "gz"
+	$(eval CTR_BASENAME := $(basename $(basename $(notdir $@))))
+	$(eval CTR_SCRATCHDIR := bin/scratch/release-container-bundle/$(CTR_BASENAME))
+	mkdir -p $(CTR_SCRATCHDIR)/server/images
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/version
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/acmesolver.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/cainjector.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/controller.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/webhook.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/ctl.docker_tag
+	cp bin/scratch/cert-manager.license $(CTR_SCRATCHDIR)/LICENSES
+	gunzip -c bin/containers/cert-manager-acmesolver-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/acmesolver.tar
+	gunzip -c bin/containers/cert-manager-cainjector-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/cainjector.tar
+	gunzip -c bin/containers/cert-manager-controller-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/controller.tar
+	gunzip -c bin/containers/cert-manager-webhook-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/webhook.tar
+	gunzip -c bin/containers/cert-manager-ctl-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/ctl.tar
+	chmod -R 755 $(CTR_SCRATCHDIR)/server/images/*
+	tar czf $@ -C bin/scratch/release-container-bundle $(CTR_BASENAME)
+	rm -rf $(CTR_SCRATCHDIR)
+
+.PHONY: release-container-metadata
+release-container-metadata: bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json
+
+bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-server-linux-%.tar.gz.metadata.json: bin/release/cert-manager-server-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
diff --git a/make/server.mk b/make/server.mk
new file mode 100644
index 000000000..9a215b9c5
--- /dev/null
+++ b/make/server.mk
@@ -0,0 +1,77 @@
+.PHONY: server-binaries
+server-binaries: controller acmesolver webhook cainjector
+
+bin/server:
+	@mkdir -p $@
+
+.PHONY: controller
+controller: bin/server/controller-linux-amd64 bin/server/controller-linux-arm64 bin/server/controller-linux-s390x bin/server/controller-linux-ppc64le bin/server/controller-linux-arm | bin/server
+
+bin/server/controller-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+.PHONY: acmesolver
+acmesolver: bin/server/acmesolver-linux-amd64 bin/server/acmesolver-linux-arm64 bin/server/acmesolver-linux-s390x bin/server/acmesolver-linux-ppc64le bin/server/acmesolver-linux-arm | bin/server
+
+bin/server/acmesolver-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+.PHONY: webhook
+webhook: bin/server/webhook-linux-amd64 bin/server/webhook-linux-arm64 bin/server/webhook-linux-s390x bin/server/webhook-linux-ppc64le bin/server/webhook-linux-arm | bin/server
+
+bin/server/webhook-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+.PHONY: cainjector
+cainjector: bin/server/cainjector-linux-amd64 bin/server/cainjector-linux-arm64 bin/server/cainjector-linux-s390x bin/server/cainjector-linux-ppc64le bin/server/cainjector-linux-arm | bin/server
+
+bin/server/cainjector-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
diff --git a/make/tools.mk b/make/tools.mk
new file mode 100644
index 000000000..13037882f
--- /dev/null
+++ b/make/tools.mk
@@ -0,0 +1,142 @@
+GO=go
+CGO_ENABLED ?= 0
+GOBUILD=CGO_ENABLED=$(CGO_ENABLED) GOMAXPROCS=$(GOBUILDPROCS) $(GO) build
+
+CTR=docker
+
+WORKDIR=$(shell pwd)
+HELM=$(WORKDIR)/bin/tools/helm
+COSIGN=$(WORKDIR)/bin/tools/cosign
+CMREL=$(WORKDIR)/bin/tools/cmrel
+YQ=$(WORKDIR)/bin/tools/yq
+
+HELM_VERSION=3.6.3
+KUBECTL_VERSION=1.22.1
+KIND_VERSION=0.11.1
+COSIGN_VERSION=1.3.1
+CMREL_VERSION=a1e2bad95be9688794fd0571c4c40e88cccf9173
+K8S_RELEASE_NOTES_VERSION=0.7.0
+YTT_VERSION=0.36.0
+YQ_VERSION=4.11.2
+
+bin/tools:
+	@mkdir -p $@
+
+bin/scratch/tools:
+	@mkdir -p $@
+
+.PHONY: tools
+tools: bin/tools/helm bin/tools/kubectl bin/tools/kind bin/tools/cosign bin/tools/release-notes bin/tools/cmrel bin/tools/ytt bin/tools/yq
+
+########
+# Helm #
+########
+
+HELM_linux_amd64_SHA256SUM=07c100849925623dc1913209cd1a30f0a9b80a5b4d6ff2153c609d11b043e262
+HELM_darwin_amd64_SHA256SUM=84a1ff17dd03340652d96e8be5172a921c97825fd278a2113c8233a4e8db5236
+HELM_darwin_arm64_SHA256SUM=a50b499dbd0bbec90761d50974bf1e67cc6d503ea20d03b4a1275884065b7e9e
+
+bin/tools/helm: bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz | bin/tools
+	@# O writes the specified file to stdout
+	tar xfO $< $(HOST_OS)-$(HOST_ARCH)/helm > $@
+	chmod +x $@
+
+bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz: | bin/scratch/tools
+	curl -sSfL https://get.helm.sh/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz > $@
+	./hack/util/checkhash.sh $@ $(HELM_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+###########
+# kubectl #
+###########
+
+KUBECTL_linux_amd64_SHA256SUM=78178a8337fc6c76780f60541fca7199f0f1a2e9c41806bded280a4a5ef665c9
+KUBECTL_darwin_amd64_SHA256SUM=00bb3947ac6ff15690f90ee1a732d0a9a44360fc7743dbfee4cba5a8f6a31413
+KUBECTL_darwin_arm64_SHA256SUM=c81a314ab7f0827a5376f8ffd6d47f913df046275d44c562915a822229819d77
+
+bin/tools/kubectl: bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://storage.googleapis.com/kubernetes-release/release/v$(KUBECTL_VERSION)/bin/$(HOST_OS)/$(HOST_ARCH)/kubectl > $@
+	./hack/util/checkhash.sh $@ $(KUBECTL_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+########
+# kind #
+########
+
+KIND_linux_amd64_SHA256SUM=949f81b3c30ca03a3d4effdecda04f100fa3edc07a28b19400f72ede7c5f0491
+KIND_darwin_amd64_SHA256SUM=432bef555a70e9360b44661c759658265b9eaaf7f75f1beec4c4d1e6bbf97ce3
+KIND_darwin_arm64_SHA256SUM=4f019c578600c087908ac59dd0c4ce1791574f153a70608adb372d5abc58cd47
+
+bin/tools/kind: bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/kubernetes-sigs/kind/releases/download/v$(KIND_VERSION)/kind-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(KIND_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+##########
+# cosign #
+##########
+
+COSIGN_linux_amd64_SHA256SUM=1227b270e5d7d21d09469253cce17b72a14f6b7c9036dfc09698c853b31e8fc8
+COSIGN_darwin_amd64_SHA256SUM=bcffa19e80f3e94d70e1fb1b0f591b0dec08926b31d3609fe3d25a1cc0389a0a
+COSIGN_darwin_arm64_SHA256SUM=eda58f090d8f4f1db5a0e3a0d2d8845626181fe8aa1cea1791e0afa87fee7b5c
+
+bin/tools/cosign: bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+# TODO: cosign also provides signatures on all of its binaries, but they can't be validated without already having cosign
+# available! We could do something like "if system cosign is available, verify using that", but for now we'll skip
+bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/sigstore/cosign/releases/download/v$(COSIGN_VERSION)/cosign-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(COSIGN_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+#########
+# cmrel #
+#########
+
+bin/tools/cmrel: | bin/tools
+	GOBIN=$(shell pwd)/$(dir $@) go install github.com/cert-manager/release/cmd/cmrel@$(CMREL_VERSION)
+
+#################
+# release-notes #
+#################
+
+bin/tools/release-notes: | bin/tools
+	GOBIN=$(shell pwd)/$(dir $@) go install k8s.io/release/cmd/release-notes@v$(K8S_RELEASE_NOTES_VERSION)
+
+#######
+# ytt #
+#######
+
+YTT_linux_amd64_SHA256SUM=d81ecf6c47209f6ac527e503a6fd85e999c3c2f8369e972794047bddc7e5fbe2
+YTT_darwin_amd64_SHA256SUM=9662e3f8e30333726a03f7a5ae6231fbfb2cebb6c1aa3f545b253d7c695487e6
+YTT_darwin_arm64_SHA256SUM=c970b2c13d4059f0bee3bf3ceaa09bd0674a62c24550453d90b284d885a06b7b
+
+bin/tools/ytt: bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/vmware-tanzu/carvel-ytt/releases/download/v$(YTT_VERSION)/ytt-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(YTT_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+######
+# yq #
+######
+
+YQ_linux_amd64_SHA256SUM=6b891fd5bb13820b2f6c1027b613220a690ce0ef4fc2b6c76ec5f643d5535e61
+YQ_darwin_amd64_SHA256SUM=5af6162d858b1adc4ad23ef11dff19ede5565d8841ac611b09500f6741ff7f46
+YQ_darwin_arm64_SHA256SUM=665ae1af7c73866cba74dd878c12ac49c091b66e46c9ed57d168b43955f5dd69
+
+bin/tools/yq: bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(HOST_OS)_$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(YQ_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)