diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..f99145275
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+bin/*
+bazel*
+
+!bin/server/**
+!bin/cmctl/cmctl-linux-*
+!bin/scratch/cert-manager.license
+!bin/scratch/cert-manager.licenses_notice
diff --git a/.gitignore b/.gitignore
index bde702fda..d4f55b169 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@ bazel-*
 /.project
 _artifacts/
 /vendor/
+bin/
diff --git a/deploy/charts/cert-manager/signkey_annotation.txt b/deploy/charts/cert-manager/signkey_annotation.txt
new file mode 100644
index 000000000..13f5c8cd1
--- /dev/null
+++ b/deploy/charts/cert-manager/signkey_annotation.txt
@@ -0,0 +1,2 @@
+fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
+url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
diff --git a/deploy/manifests/namespace.yaml b/deploy/manifests/namespace.yaml
new file mode 100644
index 000000000..c90416ff4
--- /dev/null
+++ b/deploy/manifests/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
diff --git a/hack/artifact-metadata.template.json b/hack/artifact-metadata.template.json
new file mode 100644
index 000000000..aa104d2e8
--- /dev/null
+++ b/hack/artifact-metadata.template.json
@@ -0,0 +1,6 @@
+{
+	"name": "TODO",
+	"sha256": "TODO",
+	"os": "TODO",
+	"architecture": "TODO"
+}
diff --git a/hack/concat-yaml.sh b/hack/concat-yaml.sh
new file mode 100755
index 000000000..7dee521c5
--- /dev/null
+++ b/hack/concat-yaml.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu -o pipefail
+
+while (($#)); do
+	f=$1
+	if [[ ! -f "$f" ]]; then
+		echo "$f doesn't exist, exiting" 1>&2
+		exit 1
+	fi
+
+	# The YAML spec requires that a YAML directive only appears once in a document
+	# We probably won't have any directives, so we just check for any directive and
+	# fail if there's one in any of the files
+	# https://yaml.org/spec/1.2.2/#681-yaml-directives
+	if grep -q "%YAML" $f; then
+		echo "found %YAML directive in file; this can't be handled safely by this script" 1>&2
+		exit 1
+	fi
+
+	cat $f
+
+	shift
+
+	# if there's at least one more file left, output the YAML file separator
+	if [[ $# -gt 0 ]]; then
+		echo "---"
+	fi
+done
diff --git a/hack/containers/Containerfile.acmesolver b/hack/containers/Containerfile.acmesolver
new file mode 100644
index 000000000..64d8d280a
--- /dev/null
+++ b/hack/containers/Containerfile.acmesolver
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/acmesolver/acmesolver
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/acmesolver/acmesolver"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.cainjector b/hack/containers/Containerfile.cainjector
new file mode 100644
index 000000000..31a2ba2b3
--- /dev/null
+++ b/hack/containers/Containerfile.cainjector
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/cainjector/cainjector
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/cainjector/cainjector"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.controller b/hack/containers/Containerfile.controller
new file mode 100644
index 000000000..f64d7e825
--- /dev/null
+++ b/hack/containers/Containerfile.controller
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/controller/controller
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/controller/controller"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.ctl b/hack/containers/Containerfile.ctl
new file mode 100644
index 000000000..6618ca759
--- /dev/null
+++ b/hack/containers/Containerfile.ctl
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/ctl/ctl
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/ctl/ctl"]
+
+# vim: syntax=dockerfile
diff --git a/hack/containers/Containerfile.webhook b/hack/containers/Containerfile.webhook
new file mode 100644
index 000000000..91a797093
--- /dev/null
+++ b/hack/containers/Containerfile.webhook
@@ -0,0 +1,16 @@
+ARG BASE_IMAGE
+
+FROM $BASE_IMAGE
+
+ARG BINARY_PATH
+ARG LICENSE_PATH
+ARG LICENSES_PATH
+
+COPY $BINARY_PATH /app/cmd/webhook/webhook
+
+COPY $LICENSE_PATH /licenses/LICENSE
+COPY $LICENSES_PATH /licenses/LICENSES
+
+ENTRYPOINT ["/app/cmd/webhook/webhook"]
+
+# vim: syntax=dockerfile
diff --git a/hack/latest_base_images.sh b/hack/latest-base-images.sh
similarity index 53%
rename from hack/latest_base_images.sh
rename to hack/latest-base-images.sh
index 580c45412..6fb12c6aa 100755
--- a/hack/latest_base_images.sh
+++ b/hack/latest-base-images.sh
@@ -1,7 +1,27 @@
 #!/usr/bin/env bash
 
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 set -eu -o pipefail
 
+# This script fetches the latest sha256 digest of each base image for each architecture we support on servers
+# and writes those hashes to Makefile-formatted variables for use in Makefiles.
+
+# This in turn allows us to easily update all base images to their latest versions, while mantaining the use
+# of digests rather than tags when we refer to these base images.
+
 TARGET=make/base_images.mk
 
 STATIC_BASE=gcr.io/distroless/static
@@ -9,7 +29,7 @@ DYNAMIC_BASE=gcr.io/distroless/base
 
 mkdir -p make
 
-echo "# autogenerated by hack/latest_base_images.sh" > $TARGET
+echo "# autogenerated by hack/latest-base-images.sh" > $TARGET
 
 echo "STATIC_BASE_IMAGE_amd64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-amd64)" >> $TARGET
 echo "STATIC_BASE_IMAGE_arm64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-arm64)" >> $TARGET
diff --git a/make/Makefile b/make/Makefile
new file mode 100644
index 000000000..56624f84f
--- /dev/null
+++ b/make/Makefile
@@ -0,0 +1,107 @@
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SHELL := /usr/bin/env bash
+.SHELLFLAGS := -uo pipefail -c
+
+SOURCES := $(shell find . -type f -name "*.go")
+
+GOFLAGS := -ldflags '-w -s' -trimpath
+
+# GOBUILDPROCS is passed to GOMAXPROCS when running go build; if you're running make in parallel
+# using "-jN" then you'll probably want to reduce the value of GOBUILDPROCS or else you could end
+# up running N parallel invocations of go build, each of which will spin up as many threads as are
+# available on your system.
+GOBUILDPROCS ?=
+
+# Set this as an environment variable to enable signing commands using cmrel
+# Format should be:
+# projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/cryptoKeyVersions/<keyversion>
+CMREL_KEY ?= ""
+
+HOST_OS = $(shell $(GO) env GOOS)
+HOST_ARCH = $(shell $(GO) env GOARCH)
+
+include make/git.mk
+include make/tools.mk
+include make/base_images.mk
+include make/cmctl.mk
+include make/server.mk
+include make/containers.mk
+include make/release_containers.mk
+include make/manifests.mk
+include make/licenses.mk
+
+.PHONY: all
+all: binaries helm-chart static-manifests all-containers  ## Build all artifacts which might be run or used locally, except for anything signed.
+
+.PHONY: all-signed
+all-signed: all  ## Build `all` followed by signed artifacts which require a key to be configured.
+	$(MAKE) -f make/Makefile signed-artifacts
+
+.PHONY: binaries
+binaries: server-binaries cmctl kubectl-cert_manager ## Build all binaries for all server and client platforms
+
+.PHONY: signed-artifacts
+signed-artifacts: helm-chart-signature  ## Shorthand to create all artifacts which can be signed (and which therefore require signing keys to be configured)
+
+.PHONY: staged-release
+staged-release: all-signed release-manifests release-containers ## Creates a full release ready to be staged, including containers bundled for distribution. Requires signing keys to be configured.
+	$(MAKE) -f make/Makefile bin/release/metadata.json
+
+# Takes all metadata files in bin/metadata and combines them into one
+bin/release/metadata.json: $(wildcard bin/metadata/*.json) | bin/release
+	jq -n \
+		--arg releaseVersion "$(RELEASE_VERSION)" \
+		--arg gitCommitRef "$(GITCOMMIT)" \
+		'.releaseVersion = $$releaseVersion | .gitCommitRef = $$gitCommitRef | .artifacts += [inputs]' $^ > $@
+
+.PHONY: clean
+clean:  ## Remove the bin directory, cleaning all built artifacts and locally installed tools
+	rm -rf bin
+
+bin:
+	@mkdir -p $@
+
+bin/scratch:
+	@mkdir -p $@
+
+bin/release:
+	@mkdir -p $@
+
+bin/metadata:
+	@mkdir -p $@
+
+# Set this as an environment variable to enable signing commands using cosign
+# Format should be any accepted by cosign; for GCP, use:
+# gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/versions/<keyversion>
+# CMREL_KEY ?= ""
+# Example of how we can generate a SHA256SUMS file and sign it using cosign
+#bin/SHA256SUMS: $(wildcard ...)
+#	@# The patsubst means "all dependencies, but with "bin/" trimmed off the beginning
+#	@# We cd into bin so that SHA256SUMS file doesn't have a prefix of `bin` on everything
+#	cd $(dir $@) && sha256sum $(patsubst bin/%,%,$^) > $(notdir $@)
+#
+#bin/SHA256SUMS.sig: bin/SHA256SUMS | bin/tools/cosign
+#	$(COSIGN) sign-blob --key $(COSIGN_KEY) $< > $@
+
+# This target allows us to set all the modified times for all files in bin to the same time, which
+# is similar to what bazel does. We might not want this, and it's not currently used.
+.PHONY: forcetime
+forcetime: | bin
+	find bin | xargs touch -d "2000-01-01 00:00:00" -
+
+.PHONY: help
+help: ## Display this help.
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
diff --git a/make/base_images.mk b/make/base_images.mk
new file mode 100644
index 000000000..b85c075ab
--- /dev/null
+++ b/make/base_images.mk
@@ -0,0 +1,11 @@
+# autogenerated by hack/latest-base-images.sh
+STATIC_BASE_IMAGE_amd64 := gcr.io/distroless/static@sha256:a5635fa9dda1cf81666d8c288130bf3519bdeab1b7ed717db496a73d25d1b35c
+STATIC_BASE_IMAGE_arm64 := gcr.io/distroless/static@sha256:cc7389ac8f818fa1af21bd9ff456987cc2d42577013ab2d02807c51378f5c036
+STATIC_BASE_IMAGE_s390x := gcr.io/distroless/static@sha256:3e60feae6e1cd2b6fe0d8e0c4d9811231e73b0ce4cf5059373d56d1de469ecc9
+STATIC_BASE_IMAGE_ppc64le := gcr.io/distroless/static@sha256:e0d91a3255efe07a17ca828eab3a9068e4757a1e86bc8d83c9a031ebda7a19ad
+STATIC_BASE_IMAGE_arm := gcr.io/distroless/static@sha256:a81c4c77b601a31c2b4a77ff9fd2aa7f80b1d542ea2d6cc0d9b056a6e6f17a0d
+DYNAMIC_BASE_IMAGE_amd64 := gcr.io/distroless/base@sha256:1a80a34cb3d7c4326191047976e4161741aef22c351932b55e32b72ce8827c27
+DYNAMIC_BASE_IMAGE_arm64 := gcr.io/distroless/base@sha256:f557575011fd640f984c56d74ca8f0708a50b3252a15db6e1a4895594c531bbf
+DYNAMIC_BASE_IMAGE_s390x := gcr.io/distroless/base@sha256:46c4936e7e3f20c9ae802d4ebf361966bd3a177e1342d566c52d4daad3e355b5
+DYNAMIC_BASE_IMAGE_ppc64le := gcr.io/distroless/base@sha256:a04ec0087837bc289056a5477fe2dc86745951dfe8419afe419426325cbb4c8f
+DYNAMIC_BASE_IMAGE_arm := gcr.io/distroless/base@sha256:4e72c245399db1a2f89d70ce2839c024ded5051d13e78d9d09b9a7c48155d1fd
diff --git a/make/cmctl.mk b/make/cmctl.mk
new file mode 100644
index 000000000..c8e5d8586
--- /dev/null
+++ b/make/cmctl.mk
@@ -0,0 +1,221 @@
+CMCTL_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=cmctl" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=true"'
+
+KUBECTL_PLUGIN_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=kubectl cert-manager" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=false"'
+
+bin/cmctl:
+	@mkdir -p $@
+
+bin/kubectl-cert_manager:
+	@mkdir -p $@
+
+.PHONY: cmctl
+cmctl: cmctl-linux cmctl-linux-tarballs cmctl-linux-metadata cmctl-darwin cmctl-darwin-tarballs cmctl-darwin-metadata cmctl-windows cmctl-windows-tarballs cmctl-windows-metadata | bin/cmctl
+
+.PHONY: cmctl-linux
+cmctl-linux: bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le bin/cmctl/cmctl-linux-arm | bin/cmctl
+
+.PHONY: cmctl-linux-tarballs
+cmctl-linux-tarballs: bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz | bin/release
+
+.PHONY: cmctl-linux-metadata
+cmctl-linux-metadata: bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json | bin/metadata
+
+bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le: bin/cmctl/cmctl-linux-%: $(SOURCES) | bin/cmctl
+	GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/cmctl/cmctl-linux-arm: $(SOURCES) | bin/cmctl
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz: bin/release/cert-manager-cmctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-linux-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: cmctl-darwin
+cmctl-darwin: bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64 | bin/cmctl
+
+.PHONY: cmctl-darwin-tarballs
+cmctl-darwin-tarballs: bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz | bin/release
+
+.PHONY: cmctl-darwin-metadata
+cmctl-darwin-metadata: bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json | bin/metadata
+
+bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64:  bin/cmctl/cmctl-darwin-%: $(SOURCES) | bin/cmctl
+	GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz: bin/release/cert-manager-cmctl-darwin-%.tar.gz:  bin/cmctl/cmctl-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "darwin" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: cmctl-windows
+cmctl-windows: bin/cmctl/cmctl-windows-amd64.exe | bin/cmctl
+
+.PHONY: cmctl-windows-tarballs
+cmctl-windows-tarballs: bin/release/cert-manager-cmctl-windows-amd64.tar.gz bin/release/cert-manager-cmctl-windows-amd64.zip | bin/release
+
+.PHONY: cmctl-windows-metadata
+cmctl-windows-metadata: bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json | bin/release
+
+bin/cmctl/cmctl-windows-amd64.exe: $(SOURCES) | bin/cmctl
+	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-cmctl-windows-amd64.zip: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
+	rm -rf $(TARDIR)
+
+bin/release/cert-manager-cmctl-windows-amd64.tar.gz: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/cmctl.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager
+kubectl-cert_manager: kubectl-cert_manager-linux kubectl-cert_manager-linux-tarballs kubectl-cert_manager-linux-metadata kubectl-cert_manager-darwin kubectl-cert_manager-darwin-tarballs kubectl-cert_manager-darwin-metadata kubectl-cert_manager-windows kubectl-cert_manager-windows-tarballs kubectl-cert_manager-windows-metadata | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-linux
+kubectl-cert_manager-linux: bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-linux-tarballs
+kubectl-cert_manager-linux-tarballs: bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz | bin/release
+
+.PHONY: kubectl-cert_manager-linux-metadata
+kubectl-cert_manager-linux-metadata: bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json | bin/metadata
+
+bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le: bin/kubectl-cert_manager/kubectl-cert_manager-linux-%: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-linux-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager-darwin
+kubectl-cert_manager-darwin: bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64 | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-darwin-tarballs
+kubectl-cert_manager-darwin-tarballs: bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz | bin/release
+
+.PHONY: kubectl-cert_manager-darwin-metadata
+kubectl-cert_manager-darwin-metadata: bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json | bin/metadata
+
+bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64:  bin/kubectl-cert_manager/kubectl-cert_manager-darwin-%: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz:  bin/kubectl-cert_manager/kubectl-cert_manager-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "darwin" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+.PHONY: kubectl-cert_manager-windows
+kubectl-cert_manager-windows: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe | bin/kubectl-cert_manager
+
+.PHONY: kubectl-cert_manager-windows-tarballs
+kubectl-cert_manager-windows-tarballs: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip | bin/release
+
+.PHONY: kubectl-cert_manager-windows-metadata
+kubectl-cert_manager-windows-metadata: bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json | bin/release
+
+bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe: $(SOURCES) | bin/kubectl-cert_manager
+	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
+
+bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
+	rm -rf $(TARDIR)
+
+bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
+	$(eval TARDIR := bin/scratch/$(notdir $@))
+	mkdir -p $(TARDIR)
+	cp $< $(TARDIR)/kubectl-cert_manager.exe
+	cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
+	tar czf $@ -C $(TARDIR) .
+	rm -rf $(TARDIR)
+
+bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
+
+bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "windows" \
+		--arg architecture "amd64" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
diff --git a/make/containers.mk b/make/containers.mk
new file mode 100644
index 000000000..010069f1f
--- /dev/null
+++ b/make/containers.mk
@@ -0,0 +1,118 @@
+# set to "DYNAMIC" to use a dynamic base image
+BASE_IMAGE_TYPE:=STATIC
+
+BASE_IMAGE_controller-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_controller-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_controller-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_controller-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_controller-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_webhook-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_webhook-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_webhook-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_webhook-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_webhook-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_acmesolver-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_acmesolver-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_acmesolver-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_acmesolver-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_acmesolver-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_cainjector-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_cainjector-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_cainjector-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_cainjector-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_cainjector-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+BASE_IMAGE_cmctl-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
+BASE_IMAGE_cmctl-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
+BASE_IMAGE_cmctl-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
+BASE_IMAGE_cmctl-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
+BASE_IMAGE_cmctl-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
+
+bin/containers:
+	@mkdir -p $@
+
+.PHONY: all-containers
+all-containers: cert-manager-controller-linux cert-manager-webhook-linux cert-manager-acmesolver-linux cert-manager-cainjector-linux cert-manager-ctl-linux
+
+.PHONY: cert-manager-controller-linux
+cert-manager-controller-linux: bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz
+
+bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz: bin/containers/cert-manager-controller-linux-%.tar.gz: bin/server/controller-linux-% hack/containers/Containerfile.controller bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-controller-$*:$(RELEASE_VERSION))
+	$(eval BASE := $(BASE_IMAGE_$(notdir $<)))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.controller \
+		--build-arg BASE_IMAGE=$(BASE) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-webhook-linux
+cert-manager-webhook-linux: bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz
+
+bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz: bin/containers/cert-manager-webhook-linux-%.tar.gz: bin/server/webhook-linux-% hack/containers/Containerfile.webhook bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-webhook-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.webhook \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-cainjector-linux
+cert-manager-cainjector-linux: bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz
+
+bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz: bin/containers/cert-manager-cainjector-linux-%.tar.gz: bin/server/cainjector-linux-% hack/containers/Containerfile.cainjector bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-cainjector-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.cainjector \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-acmesolver-linux
+cert-manager-acmesolver-linux: bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz
+
+bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz: bin/server/acmesolver-linux-% hack/containers/Containerfile.acmesolver bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-acmesolver-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.acmesolver \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
+
+.PHONY: cert-manager-ctl-linux
+cert-manager-ctl-linux: bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz
+
+bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz: bin/containers/cert-manager-ctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% hack/containers/Containerfile.ctl bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
+	$(eval TAG := cert-manager-ctl-$*:$(RELEASE_VERSION))
+	$(eval BASE := BASE_IMAGE_$(notdir $<))
+	$(CTR) build --quiet \
+		-f hack/containers/Containerfile.ctl \
+		--build-arg BASE_IMAGE=$($(BASE)) \
+		--build-arg BINARY_PATH=$< \
+		--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
+		--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
+		-t $(TAG) \
+		.
+	$(CTR) save $(TAG) | gzip > $@
diff --git a/make/git.mk b/make/git.mk
new file mode 100644
index 000000000..270454db8
--- /dev/null
+++ b/make/git.mk
@@ -0,0 +1,14 @@
+RELEASE_VERSION := $(shell git describe --tags)
+
+GITCOMMIT := $(shell git rev-parse HEAD)
+
+IS_TAGGED_RELEASE := $(shell git describe --exact-match HEAD >/dev/null 2>&1 && echo "true" || echo "false")
+
+IS_PRERELEASE := $(shell echo $(RELEASE_VERSION) | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$$' - && echo "false" || echo "true")
+
+.PHONY: gitver
+gitver:
+	@echo "Release version:   \"$(RELEASE_VERSION)\""
+	@echo "Is tagged release: \"$(IS_TAGGED_RELEASE)\""
+	@echo "Is prerelease:     \"$(IS_PRERELEASE)\""
+	@echo "Git commit hash:   \"$(GITCOMMIT)\""
diff --git a/make/licenses.mk b/make/licenses.mk
new file mode 100644
index 000000000..5a656c604
--- /dev/null
+++ b/make/licenses.mk
@@ -0,0 +1,23 @@
+# LICENSE_YEAR is the value which will be substituted into licenses when they're generated
+# It would be possible to make this more dynamic, but there's seemingly no need:
+# https://stackoverflow.com/a/2391555/1615417
+# As such, this is hardcoded to avoid needless complexity
+LICENSE_YEAR=2021
+
+# Creates the boilerplate header for YAML files, assumed to be the same as the one in
+# shell scripts (hence the use of boilerplate.sh.txt)
+bin/scratch/license.yaml: hack/boilerplate/boilerplate.sh.txt | bin/scratch
+	sed -e "s/YEAR/$(LICENSE_YEAR)/g" < $< > $@
+
+# The references LICENSES file is 1.4MB at the time of writing. Bundling it into every container image
+# seems wasteful in terms of bytes stored and bytes transferred on the wire just to add a file
+# which presumably nobody will ever read or care about. Instead, just add a little footnote pointing
+# to the cert-manager repo in case anybody actually decides that they care.
+bin/scratch/license-footnote.yaml: | bin/scratch
+	@echo -e "# To view licenses for cert-manager dependencies, see the LICENSES file in the\n# cert-manager repo: https://github.com/jetstack/cert-manager" > $@
+
+bin/scratch/cert-manager.license: bin/scratch/license.yaml bin/scratch/license-footnote.yaml | bin/scratch
+	cat $^ > $@
+
+bin/scratch/cert-manager.licenses_notice: bin/scratch/license-footnote.yaml | bin/scratch
+	cp $< $@
diff --git a/make/manifests.mk b/make/manifests.mk
new file mode 100644
index 000000000..6bf57bae5
--- /dev/null
+++ b/make/manifests.mk
@@ -0,0 +1,168 @@
+HELM_CMD=./bin/tools/helm
+
+ALLCRDS=deploy/crds/crd-certificaterequests.yaml deploy/crds/crd-certificates.yaml deploy/crds/crd-challenges.yaml deploy/crds/crd-clusterissuers.yaml deploy/crds/crd-issuers.yaml deploy/crds/crd-orders.yaml
+
+HELM_TEMPLATE_SOURCES=$(wildcard deploy/charts/cert-manager/templates/*.yaml)
+HELM_TEMPLATE_TARGETS=$(patsubst deploy/charts/cert-manager/templates/%,bin/helm/cert-manager/templates/%,$(HELM_TEMPLATE_SOURCES))
+
+####################
+# Friendly Targets #
+####################
+
+# These targets provide friendly names for the various manifests / charts we build
+
+.PHONY: helm-chart
+helm-chart: bin/cert-manager-$(RELEASE_VERSION).tgz
+
+.PHONY: helm-chart-signature
+helm-chart-signature: bin/cert-manager-$(RELEASE_VERSION).tgz.prov
+
+.PHONY: static-manifests
+static-manifests: bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml
+
+###################
+# Release Targets #
+###################
+
+.PHONY: release-manifests
+release-manifests: bin/release/cert-manager-manifests.tar.gz bin/metadata/cert-manager-manifests.tar.gz.metadata.json
+
+bin/release/cert-manager-manifests.tar.gz: bin/cert-manager-$(RELEASE_VERSION).tgz bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/cert-manager-$(RELEASE_VERSION).tgz.prov | bin/scratch/manifests bin/release
+	mkdir -p bin/scratch/manifests/deploy/chart/
+	mkdir -p bin/scratch/manifests/deploy/manifests/
+	cp bin/cert-manager-$(RELEASE_VERSION).tgz bin/cert-manager-$(RELEASE_VERSION).tgz.prov bin/scratch/manifests/deploy/chart/
+	cp bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/scratch/manifests/deploy/manifests/
+	tar czf $@ -C bin/scratch/manifests .
+	rm -rf bin/scratch/manifests
+
+# This metadata blob is constructed slightly differently and doesn't use hack/artifact-metadata.template.json directly;
+# this is because the bazel staged releases didn't include an "os" or "architecture" field for this artifact
+bin/metadata/cert-manager-manifests.tar.gz.metadata.json: bin/release/cert-manager-manifests.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq -n --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		'.name = $$name | .sha256 = $$sha256' > $@
+
+################
+# Helm Targets #
+################
+
+# These targets provide for building and signing the cert-manager helm chart.
+
+bin/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager/README.md bin/helm/cert-manager/Chart.yaml bin/helm/cert-manager/values.yaml $(HELM_TEMPLATE_TARGETS) bin/helm/cert-manager/templates/NOTES.txt bin/helm/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager bin/tools/helm
+	$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager
+
+bin/cert-manager-$(RELEASE_VERSION).tgz.prov: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/helm/cert-manager bin/tools/cmrel
+ifeq ($(strip $(CMREL_KEY)),)
+	$(error Trying to sign helm chart but CMREL_KEY is empty)
+endif
+	cd $(dir $<) && $(CMREL) sign helm --chart-path "$(notdir $<)" --key "$(CMREL_KEY)"
+
+$(HELM_TEMPLATE_TARGETS): $(HELM_TEMPLATE_SOURCES) | bin/helm/cert-manager/templates
+	cp -f $^ $(dir $@)
+
+bin/helm/cert-manager/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager/templates
+	cp $< $@
+
+bin/helm/cert-manager/templates/NOTES.txt: deploy/charts/cert-manager/templates/NOTES.txt | bin/helm/cert-manager/templates
+	cp $< $@
+
+bin/helm/cert-manager/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
+	cp $< $@
+
+bin/helm/cert-manager/README.md: deploy/charts/cert-manager/README.template.md | bin/helm/cert-manager
+	sed -e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
+
+bin/helm/cert-manager/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml deploy/charts/cert-manager/signkey_annotation.txt | bin/helm/cert-manager bin/tools/yq
+	@# this horrible mess is taken from the YQ manual's example of multiline string blocks from a file:
+	@# https://mikefarah.gitbook.io/yq/operators/string-operators#string-blocks-bash-and-newlines
+	@# we set a bash variable called SIGNKEY_ANNOTATION using read, and then use that bash variable in yq
+	IFS= read -rd '' SIGNKEY_ANNOTATION < <(cat deploy/charts/cert-manager/signkey_annotation.txt) ; \
+		SIGNKEY_ANNOTATION=$$SIGNKEY_ANNOTATION $(YQ) eval \
+		'.annotations."artifacthub.io/signKey" = strenv(SIGNKEY_ANNOTATION) | .annotations."artifacthub.io/prerelease" = "$(IS_PRERELEASE)" | .version = "$(RELEASE_VERSION)" | .appVersion = "$(RELEASE_VERSION)"' \
+		$< > $@
+
+#################################
+# Targets for cert-manager.yaml #
+#################################
+
+# These targets depend on the cert-manager helm chart and the creation of the standalone CRDs.
+# They use `helm template` to create a single static YAML manifest containing all resources
+# with templating completed, and then concatenate with the cert-manager namespace and the CRDs.
+
+bin/yaml/cert-manager.yaml: bin/scratch/license.yaml deploy/manifests/namespace.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml bin/scratch/yaml/cert-manager-static-resources.yaml | bin/yaml
+	@# NB: filter-out removes the license (the first dependency, $<) from the YAML concatenation
+	./hack/concat-yaml.sh $(filter-out $<, $^) | cat $< - > $@
+
+# Renders all resources except the namespace and the CRDs
+bin/scratch/yaml/cert-manager-static-resources.yaml: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
+	# The sed command removes the first line but only if it matches "---", which helm adds
+	$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
+		sed -e "1{/^---$$/d;}" > $@
+
+######################################
+# Targets for cert-manager.crds.yaml #
+######################################
+
+# These targets generate a dummy helm chart containing _only_ our CRDs, and then uses `helm template`
+# to create a single YAML file containing all CRDS with the templating completed
+
+# CRDs with a license
+bin/yaml/cert-manager.crds.yaml: bin/scratch/license.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml | bin/yaml
+	cat $^ > $@
+
+bin/scratch/yaml/cert-manager.crds.unlicensed.yaml: bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
+	# The sed command removes the first line but only if it matches "---", which helm adds
+	$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
+		sed -e "1{/^---$$/d;}" > $@
+
+bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager-crds/templates/_helpers.tpl bin/helm/cert-manager-crds/templates/crd-templates.yaml bin/helm/cert-manager-crds/README.md bin/helm/cert-manager-crds/Chart.yaml bin/helm/cert-manager-crds/values.yaml  | bin/scratch bin/tools/helm
+	$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager-crds
+
+# create a temporary chart containing the cert-manager CRDs in order to use helm's
+# templating engine to create usable CRDs for static installation
+bin/helm/cert-manager-crds/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml | bin/helm/cert-manager-crds
+	sed -e "s:{{IS_PRERELEASE}}:$(IS_PRERELEASE):g" \
+		-e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
+
+bin/helm/cert-manager-crds/README.md: | bin/helm/cert-manager-crds
+	@echo "This chart is a cert-manager build artifact, do not use" > $@
+
+bin/helm/cert-manager-crds/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
+	cp $< $@
+
+bin/helm/cert-manager-crds/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager-crds/templates
+	cp $< $@
+
+bin/helm/cert-manager-crds/templates/crd-templates.yaml: bin/scratch/yaml/cert-manager-crd-templates.yaml | bin/helm/cert-manager-crds/templates
+	cp $< $@
+
+# Create a single file containing all CRDs before they've been templated
+bin/scratch/yaml/cert-manager-crd-templates.yaml: $(ALLCRDS) | bin/scratch/yaml
+	./hack/concat-yaml.sh $^ > $@
+
+###############
+# Dir targets #
+###############
+
+# These targets are trivial, to ensure that dirs exist
+
+bin/yaml:
+	@mkdir -p $@
+
+bin/helm/cert-manager:
+	@mkdir -p $@
+
+bin/helm/cert-manager/templates:
+	@mkdir -p $@
+
+bin/helm/cert-manager-crds:
+	@mkdir -p $@
+
+bin/helm/cert-manager-crds/templates:
+	@mkdir -p $@
+
+bin/scratch/yaml:
+	@mkdir -p $@
+
+bin/scratch/manifests:
+	@mkdir -p $@
diff --git a/make/release_containers.mk b/make/release_containers.mk
new file mode 100644
index 000000000..fca9d806e
--- /dev/null
+++ b/make/release_containers.mk
@@ -0,0 +1,37 @@
+.PHONY: release-containers
+release-containers: release-container-bundles release-container-metadata
+
+.PHONY: release-container-bundles
+release-container-bundles: bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz
+
+bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz: bin/release/cert-manager-server-linux-%.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz bin/containers/cert-manager-cainjector-linux-%.tar.gz bin/containers/cert-manager-controller-linux-%.tar.gz bin/containers/cert-manager-webhook-linux-%.tar.gz bin/containers/cert-manager-ctl-linux-%.tar.gz bin/scratch/cert-manager.license | bin/release bin/scratch
+	@# use basename twice to strip both "tar" and "gz"
+	$(eval CTR_BASENAME := $(basename $(basename $(notdir $@))))
+	$(eval CTR_SCRATCHDIR := bin/scratch/release-container-bundle/$(CTR_BASENAME))
+	mkdir -p $(CTR_SCRATCHDIR)/server/images
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/version
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/acmesolver.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/cainjector.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/controller.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/webhook.docker_tag
+	echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/ctl.docker_tag
+	cp bin/scratch/cert-manager.license $(CTR_SCRATCHDIR)/LICENSES
+	gunzip -c bin/containers/cert-manager-acmesolver-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/acmesolver.tar
+	gunzip -c bin/containers/cert-manager-cainjector-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/cainjector.tar
+	gunzip -c bin/containers/cert-manager-controller-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/controller.tar
+	gunzip -c bin/containers/cert-manager-webhook-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/webhook.tar
+	gunzip -c bin/containers/cert-manager-ctl-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/ctl.tar
+	chmod -R 755 $(CTR_SCRATCHDIR)/server/images/*
+	tar czf $@ -C bin/scratch/release-container-bundle $(CTR_BASENAME)
+	rm -rf $(CTR_SCRATCHDIR)
+
+.PHONY: release-container-metadata
+release-container-metadata: bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json
+
+bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-server-linux-%.tar.gz.metadata.json: bin/release/cert-manager-server-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
+	jq --arg name "$(notdir $<)" \
+		--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
+		--arg os "linux" \
+		--arg architecture "$*" \
+		'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
+		hack/artifact-metadata.template.json > $@
diff --git a/make/server.mk b/make/server.mk
new file mode 100644
index 000000000..9a215b9c5
--- /dev/null
+++ b/make/server.mk
@@ -0,0 +1,77 @@
+.PHONY: server-binaries
+server-binaries: controller acmesolver webhook cainjector
+
+bin/server:
+	@mkdir -p $@
+
+.PHONY: controller
+controller: bin/server/controller-linux-amd64 bin/server/controller-linux-arm64 bin/server/controller-linux-s390x bin/server/controller-linux-ppc64le bin/server/controller-linux-arm | bin/server
+
+bin/server/controller-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+bin/server/controller-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
+
+.PHONY: acmesolver
+acmesolver: bin/server/acmesolver-linux-amd64 bin/server/acmesolver-linux-arm64 bin/server/acmesolver-linux-s390x bin/server/acmesolver-linux-ppc64le bin/server/acmesolver-linux-arm | bin/server
+
+bin/server/acmesolver-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+bin/server/acmesolver-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
+
+.PHONY: webhook
+webhook: bin/server/webhook-linux-amd64 bin/server/webhook-linux-arm64 bin/server/webhook-linux-s390x bin/server/webhook-linux-ppc64le bin/server/webhook-linux-arm | bin/server
+
+bin/server/webhook-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+bin/server/webhook-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
+
+.PHONY: cainjector
+cainjector: bin/server/cainjector-linux-amd64 bin/server/cainjector-linux-arm64 bin/server/cainjector-linux-s390x bin/server/cainjector-linux-ppc64le bin/server/cainjector-linux-arm | bin/server
+
+bin/server/cainjector-linux-amd64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-arm64: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-s390x: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-ppc64le: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
+
+bin/server/cainjector-linux-arm: $(SOURCES) | bin/server
+	GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
diff --git a/make/tools.mk b/make/tools.mk
new file mode 100644
index 000000000..13037882f
--- /dev/null
+++ b/make/tools.mk
@@ -0,0 +1,142 @@
+GO=go
+CGO_ENABLED ?= 0
+GOBUILD=CGO_ENABLED=$(CGO_ENABLED) GOMAXPROCS=$(GOBUILDPROCS) $(GO) build
+
+CTR=docker
+
+WORKDIR=$(shell pwd)
+HELM=$(WORKDIR)/bin/tools/helm
+COSIGN=$(WORKDIR)/bin/tools/cosign
+CMREL=$(WORKDIR)/bin/tools/cmrel
+YQ=$(WORKDIR)/bin/tools/yq
+
+HELM_VERSION=3.6.3
+KUBECTL_VERSION=1.22.1
+KIND_VERSION=0.11.1
+COSIGN_VERSION=1.3.1
+CMREL_VERSION=a1e2bad95be9688794fd0571c4c40e88cccf9173
+K8S_RELEASE_NOTES_VERSION=0.7.0
+YTT_VERSION=0.36.0
+YQ_VERSION=4.11.2
+
+bin/tools:
+	@mkdir -p $@
+
+bin/scratch/tools:
+	@mkdir -p $@
+
+.PHONY: tools
+tools: bin/tools/helm bin/tools/kubectl bin/tools/kind bin/tools/cosign bin/tools/release-notes bin/tools/cmrel bin/tools/ytt bin/tools/yq
+
+########
+# Helm #
+########
+
+HELM_linux_amd64_SHA256SUM=07c100849925623dc1913209cd1a30f0a9b80a5b4d6ff2153c609d11b043e262
+HELM_darwin_amd64_SHA256SUM=84a1ff17dd03340652d96e8be5172a921c97825fd278a2113c8233a4e8db5236
+HELM_darwin_arm64_SHA256SUM=a50b499dbd0bbec90761d50974bf1e67cc6d503ea20d03b4a1275884065b7e9e
+
+bin/tools/helm: bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz | bin/tools
+	@# O writes the specified file to stdout
+	tar xfO $< $(HOST_OS)-$(HOST_ARCH)/helm > $@
+	chmod +x $@
+
+bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz: | bin/scratch/tools
+	curl -sSfL https://get.helm.sh/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz > $@
+	./hack/util/checkhash.sh $@ $(HELM_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+###########
+# kubectl #
+###########
+
+KUBECTL_linux_amd64_SHA256SUM=78178a8337fc6c76780f60541fca7199f0f1a2e9c41806bded280a4a5ef665c9
+KUBECTL_darwin_amd64_SHA256SUM=00bb3947ac6ff15690f90ee1a732d0a9a44360fc7743dbfee4cba5a8f6a31413
+KUBECTL_darwin_arm64_SHA256SUM=c81a314ab7f0827a5376f8ffd6d47f913df046275d44c562915a822229819d77
+
+bin/tools/kubectl: bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://storage.googleapis.com/kubernetes-release/release/v$(KUBECTL_VERSION)/bin/$(HOST_OS)/$(HOST_ARCH)/kubectl > $@
+	./hack/util/checkhash.sh $@ $(KUBECTL_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+########
+# kind #
+########
+
+KIND_linux_amd64_SHA256SUM=949f81b3c30ca03a3d4effdecda04f100fa3edc07a28b19400f72ede7c5f0491
+KIND_darwin_amd64_SHA256SUM=432bef555a70e9360b44661c759658265b9eaaf7f75f1beec4c4d1e6bbf97ce3
+KIND_darwin_arm64_SHA256SUM=4f019c578600c087908ac59dd0c4ce1791574f153a70608adb372d5abc58cd47
+
+bin/tools/kind: bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/kubernetes-sigs/kind/releases/download/v$(KIND_VERSION)/kind-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(KIND_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+##########
+# cosign #
+##########
+
+COSIGN_linux_amd64_SHA256SUM=1227b270e5d7d21d09469253cce17b72a14f6b7c9036dfc09698c853b31e8fc8
+COSIGN_darwin_amd64_SHA256SUM=bcffa19e80f3e94d70e1fb1b0f591b0dec08926b31d3609fe3d25a1cc0389a0a
+COSIGN_darwin_arm64_SHA256SUM=eda58f090d8f4f1db5a0e3a0d2d8845626181fe8aa1cea1791e0afa87fee7b5c
+
+bin/tools/cosign: bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+# TODO: cosign also provides signatures on all of its binaries, but they can't be validated without already having cosign
+# available! We could do something like "if system cosign is available, verify using that", but for now we'll skip
+bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/sigstore/cosign/releases/download/v$(COSIGN_VERSION)/cosign-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(COSIGN_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+#########
+# cmrel #
+#########
+
+bin/tools/cmrel: | bin/tools
+	GOBIN=$(shell pwd)/$(dir $@) go install github.com/cert-manager/release/cmd/cmrel@$(CMREL_VERSION)
+
+#################
+# release-notes #
+#################
+
+bin/tools/release-notes: | bin/tools
+	GOBIN=$(shell pwd)/$(dir $@) go install k8s.io/release/cmd/release-notes@v$(K8S_RELEASE_NOTES_VERSION)
+
+#######
+# ytt #
+#######
+
+YTT_linux_amd64_SHA256SUM=d81ecf6c47209f6ac527e503a6fd85e999c3c2f8369e972794047bddc7e5fbe2
+YTT_darwin_amd64_SHA256SUM=9662e3f8e30333726a03f7a5ae6231fbfb2cebb6c1aa3f545b253d7c695487e6
+YTT_darwin_arm64_SHA256SUM=c970b2c13d4059f0bee3bf3ceaa09bd0674a62c24550453d90b284d885a06b7b
+
+bin/tools/ytt: bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/vmware-tanzu/carvel-ytt/releases/download/v$(YTT_VERSION)/ytt-$(HOST_OS)-$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(YTT_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
+
+######
+# yq #
+######
+
+YQ_linux_amd64_SHA256SUM=6b891fd5bb13820b2f6c1027b613220a690ce0ef4fc2b6c76ec5f643d5535e61
+YQ_darwin_amd64_SHA256SUM=5af6162d858b1adc4ad23ef11dff19ede5565d8841ac611b09500f6741ff7f46
+YQ_darwin_arm64_SHA256SUM=665ae1af7c73866cba74dd878c12ac49c091b66e46c9ed57d168b43955f5dd69
+
+bin/tools/yq: bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH) | bin/tools
+	cp $< $@
+	chmod +x $@
+
+bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
+	curl -sSfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(HOST_OS)_$(HOST_ARCH) > $@
+	./hack/util/checkhash.sh $@ $(YQ_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)