diff --git a/Makefile b/Makefile
index 6dab51784..b4933fe16 100644
--- a/Makefile
+++ b/Makefile
@@ -68,8 +68,10 @@ help:
 	# images             - builds docker images for all of the components, saving them in your Docker daemon
 	# images_push        - pushes docker images to the target registry
 	# crds               - runs the update-crds script to ensure that generated CRDs are up to date
-	# cluster            - creates a Kubernetes cluster for testing in CI (KIND by default)
+	# cluster            - creates a Kubernetes cluster for testing in CI, but doesn't install addons (KIND by default)
+	# ci-cluster         - creates a Kubernetes cluster for testing in CI installing several required addons (KIND by default)
 	# release_tars       - build the release tar files.
+	# update_kind_images - updates the digests of the kind images used for testing + CI across various K8S versions
 	#
 	# All image targets can be run with optional args DOCKER_REGISTRY, APP_VERSION, PLATFORM:
 	#
@@ -116,6 +118,18 @@ crds:
 cluster:
 	./devel/ci-cluster.sh
 
+.PHONY: ci-cluster
+ci-cluster: cluster
+	./devel/setup-e2e-deps.sh
+
+.PHONY: update_kind_images
+update_kind_images: devel/cluster/kind_cluster_node_versions.sh
+
+# has to be PHONY since it relies on remote data
+.PHONY: devel/cluster/kind_cluster_node_versions.sh
+devel/cluster/kind_cluster_node_versions.sh:
+	./hack/latest-kind-images.sh > $@
+
 # Go targets
 ############
 .PHONY: $(CMDS)
diff --git a/devel/cluster/create-kind.sh b/devel/cluster/create-kind.sh
index 2653b291a..330f28c35 100755
--- a/devel/cluster/create-kind.sh
+++ b/devel/cluster/create-kind.sh
@@ -20,7 +20,7 @@ set -o pipefail
 
 SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
 source "${SCRIPT_ROOT}/../lib/lib.sh"
-SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
+source "${SCRIPT_ROOT}/../cluster/kind_cluster_node_versions.sh"
 
 setup_tools
 
@@ -32,27 +32,24 @@ KIND_BIN="${KIND}"
 
 # Compute the details of the kind image to use
 export KIND_IMAGE_SHA=""
-if [[ "$K8S_VERSION" =~ 1\.16 ]] ; then
-  # v1.16.9@sha256:7175872357bc85847ec4b1aba46ed1d12fa054c83ac7a8a11f5c268957fd5765
-  KIND_IMAGE_SHA="sha256:83067ed51bf2a3395b24687094e283a7c7c865ccc12a8b1d7aa673ba0c5e8861"
-elif [[ "$K8S_VERSION" =~ 1\.17 ]] ; then
-  # v1.17.5@sha256:ab3f9e6ec5ad8840eeb1f76c89bb7948c77bbf76bcebe1a8b59790b8ae9a283a
-  KIND_IMAGE_SHA="sha256:66f1d0d91a88b8a001811e2f1054af60eef3b669a9a74f9b6db871f2f1eeed00"
-elif [[ "$K8S_VERSION" =~ 1\.18 ]] ; then
-  # v1.18.2@sha256:7b27a6d0f2517ff88ba444025beae41491b016bc6af573ba467b70c5e8e0d85f
-  KIND_IMAGE_SHA="sha256:7af1492e19b3192a79f606e43c35fb741e520d195f96399284515f077b3b622c"
+
+# NB: Kind cluster image digests are autogenerated by hack/update-kind-images.sh
+
+if [[ "$K8S_VERSION" =~ 1\.18 ]] ; then
+  KIND_IMAGE_SHA=$KIND_IMAGE_SHA_K8S_118
 elif [[ "$K8S_VERSION" =~ 1\.19 ]] ; then
-  KIND_IMAGE_SHA="sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729"
+  KIND_IMAGE_SHA=$KIND_IMAGE_SHA_K8S_119
 elif [[ "$K8S_VERSION" =~ 1\.20 ]] ; then
-  KIND_IMAGE_SHA="sha256:cbeaf907fc78ac97ce7b625e4bf0de16e3ea725daf6b04f930bd14c67c671ff9"
+  KIND_IMAGE_SHA=$KIND_IMAGE_SHA_K8S_120
 elif [[ "$K8S_VERSION" =~ 1\.21 ]] ; then
-  KIND_IMAGE_SHA="sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
+  KIND_IMAGE_SHA=$KIND_IMAGE_SHA_K8S_121
 elif [[ "$K8S_VERSION" =~ 1\.22 ]] ; then
-  KIND_IMAGE_SHA="sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047"
+  KIND_IMAGE_SHA=$KIND_IMAGE_SHA_K8S_122
 else
-  echo "Unrecognised Kubernetes version '${K8S_VERSION}'! Aborting..."
+  echo "Unrecognised/unsupported Kubernetes version '${K8S_VERSION}'! Aborting..."
   exit 1
 fi
+
 export KIND_IMAGE="${KIND_IMAGE_REPO}@${KIND_IMAGE_SHA}"
 echo "kind image details:"
 echo "  repo:    ${KIND_IMAGE_REPO}"
diff --git a/devel/cluster/kind_cluster_node_versions.sh b/devel/cluster/kind_cluster_node_versions.sh
new file mode 100644
index 000000000..0eae9d47b
--- /dev/null
+++ b/devel/cluster/kind_cluster_node_versions.sh
@@ -0,0 +1,24 @@
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# these are manually set to a known-good configuration so that the PR adding the auto-generation script
+# can be merged without also changing the kind images
+
+# in the future, this file will be auto-generated by ./hack/latest-kind-images.sh
+
+KIND_IMAGE_SHA_K8S_118=sha256:7af1492e19b3192a79f606e43c35fb741e520d195f96399284515f077b3b622c
+KIND_IMAGE_SHA_K8S_119=sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729
+KIND_IMAGE_SHA_K8S_120=sha256:cbeaf907fc78ac97ce7b625e4bf0de16e3ea725daf6b04f930bd14c67c671ff9
+KIND_IMAGE_SHA_K8S_121=sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
+KIND_IMAGE_SHA_K8S_122=sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047
diff --git a/devel/lib/lib.sh b/devel/lib/lib.sh
index 11c75b71d..a6792615e 100644
--- a/devel/lib/lib.sh
+++ b/devel/lib/lib.sh
@@ -23,7 +23,7 @@ export REPO_ROOT="$LIB_ROOT/../.."
 
 export SKIP_BUILD_ADDON_IMAGES="${SKIP_BUILD_ADDON_IMAGES:-}"
 export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
-export KIND_IMAGE_REPO="kindest/node"
+export KIND_IMAGE_REPO="docker.io/kindest/node"
 # Default Kubernetes version to use to 1.22
 export K8S_VERSION=${K8S_VERSION:-1.22}
 # Default OpenShift version to use to 3.11
diff --git a/hack/latest-kind-images.sh b/hack/latest-kind-images.sh
new file mode 100755
index 000000000..ef2672606
--- /dev/null
+++ b/hack/latest-kind-images.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu -o pipefail
+
+# source this lib for KIND_IMAGE_REPO
+source "devel/lib/lib.sh"
+
+CRANE=crane
+TAGS=$(mktemp)
+
+trap 'rm -f -- "$TAGS"' EXIT
+
+if ! which $CRANE >/dev/null 2>&1; then
+	echo -e "Couldn't find crane. Try running:\ngo install github.com/google/go-containerregistry/cmd/crane@latest" >&2
+	exit 1
+fi
+
+function latest_kind_tag () {
+	grep -E "^v$1" $TAGS | sort | tail -1
+}
+
+$CRANE ls $KIND_IMAGE_REPO > $TAGS
+
+# the TAGS file will now look like:
+# ...
+# v1.19.4
+# v1.19.7
+# v1.20.0
+# v1.20.2
+# v1.20.7
+# ...
+
+LATEST_118_TAG=$(latest_kind_tag "1\\.18")
+LATEST_119_TAG=$(latest_kind_tag "1\\.19")
+LATEST_120_TAG=$(latest_kind_tag "1\\.20")
+LATEST_121_TAG=$(latest_kind_tag "1\\.21")
+LATEST_122_TAG=$(latest_kind_tag "1\\.22")
+
+LATEST_118_DIGEST=$(crane digest $KIND_IMAGE_REPO:$LATEST_118_TAG)
+LATEST_119_DIGEST=$(crane digest $KIND_IMAGE_REPO:$LATEST_119_TAG)
+LATEST_120_DIGEST=$(crane digest $KIND_IMAGE_REPO:$LATEST_120_TAG)
+LATEST_121_DIGEST=$(crane digest $KIND_IMAGE_REPO:$LATEST_121_TAG)
+LATEST_122_DIGEST=$(crane digest $KIND_IMAGE_REPO:$LATEST_122_TAG)
+
+cat << EOF
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# generated by $0
+
+KIND_IMAGE_SHA_K8S_118=$LATEST_118_DIGEST
+KIND_IMAGE_SHA_K8S_119=$LATEST_119_DIGEST
+KIND_IMAGE_SHA_K8S_120=$LATEST_120_DIGEST
+KIND_IMAGE_SHA_K8S_121=$LATEST_121_DIGEST
+KIND_IMAGE_SHA_K8S_122=$LATEST_122_DIGEST
+EOF