diff --git a/WORKSPACE b/WORKSPACE
index 3e0ac2cc2..ababf18a6 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -309,6 +309,13 @@ npm_install(
     package_lock_json = "//docs/generated/reference/generate/bin:package-lock.json",
 )
 
+# Load the controller-tools repository in order to build the crd generator tool
+go_repository(
+    name = "io_kubernetes_sigs_controller-tools",
+    commit = "94656be085bdbd48c49be0a41c91e4fc5ea5b1ee",
+    importpath = "sigs.k8s.io/controller-tools",
+)
+
 # Load kubernetes-incubator/reference-docs, to be used as part of the docs
 # generation pipeline.
 # This involves quite a few dependencies, hence the long list of go_repository
diff --git a/hack/BUILD.bazel b/hack/BUILD.bazel
index 4bec2cb4b..f616038bf 100644
--- a/hack/BUILD.bazel
+++ b/hack/BUILD.bazel
@@ -150,6 +150,30 @@ sh_test(
     ],
 )
 
+sh_binary(
+    name = "update-crds",
+    srcs = ["update-crds.sh"],
+    data = [
+        ":update-deploy-gen",
+        "//hack/bin:gencrd",
+        "//pkg/apis:all-srcs",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:all-srcs",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:all-srcs",
+    ],
+)
+
+sh_test(
+    name = "verify-crds",
+    srcs = ["verify-crds.sh"],
+    data = [
+        ":update-crds",
+        "//deploy:all-srcs",
+        "//hack/bin:gencrd",
+        "//pkg/apis:all-srcs",
+    ],
+)
+
 filegroup(
     name = "package-srcs",
     srcs = glob(["**"]),
diff --git a/hack/bin/BUILD.bazel b/hack/bin/BUILD.bazel
index 020c7cc8a..a819d9637 100644
--- a/hack/bin/BUILD.bazel
+++ b/hack/bin/BUILD.bazel
@@ -63,6 +63,14 @@ genrule(
     visibility = ["//visibility:public"],
 )
 
+genrule(
+    name = "fetch_gencrd",
+    srcs = ["@io_kubernetes_sigs_controller-tools//cmd/crd"],
+    outs = ["gencrd"],
+    cmd = "cp $(SRCS) $@",
+    visibility = ["//visibility:public"],
+)
+
 config_setting(
     name = "k8",
     values = {"host_cpu": "k8"},
diff --git a/hack/update-crds.sh b/hack/update-crds.sh
new file mode 100755
index 000000000..38af45e9f
--- /dev/null
+++ b/hack/update-crds.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+# Copyright 2019 The Jetstack cert-manager contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# This script should be run via `bazel run //hack:update-crds`
+REPO_ROOT=${BUILD_WORKSPACE_DIRECTORY:-"$(cd "$(dirname "$0")" && pwd -P)"/..}
+runfiles="$(pwd)"
+export PATH="${runfiles}/hack/bin:${PATH}"
+cd "${REPO_ROOT}"
+
+output="$(mktemp -d)"
+gencrd generate \
+    --domain "k8s.io" \
+    --output-dir "${output}"
+
+echo "Copying files to output file"
+out="deploy/manifests/00-crds.yaml"
+rm "$out" > /dev/null 2>&1 || true
+mkdir -p "$(dirname $out)"
+touch "$out"
+for file in ${output}/*; do
+    cat "$file" >> "$out"
+    echo "---" >> "$out"
+done
+
+hack/update-deploy-gen.sh
diff --git a/hack/verify-crds.sh b/hack/verify-crds.sh
new file mode 100755
index 000000000..9a8232ab1
--- /dev/null
+++ b/hack/verify-crds.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+# Copyright 2019 The Jetstack cert-manager contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+RULE_NAME="crds"
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
+
+_tmp="$(mktemp -d)"
+DIFFROOT="${SCRIPT_ROOT}/"
+
+cleanup() {
+  rm -rf "${_tmp}"
+}
+trap "cleanup" EXIT SIGINT
+
+# Create a fake GOPATH
+export GOPATH="${_tmp}"
+TMP_DIFFROOT="${GOPATH}/src/github.com/jetstack/cert-manager"
+
+mkdir -p "${TMP_DIFFROOT}"
+rsync -avvL "${DIFFROOT}"/ "${TMP_DIFFROOT}" >/dev/null
+# remove __main__ directory copied to tmp
+rm -Rf "${TMP_DIFFROOT}/__main__"
+
+cd "${TMP_DIFFROOT}"
+export BUILD_WORKSPACE_DIRECTORY="$(pwd)"
+"hack/update-${RULE_NAME}.sh"
+
+echo "diffing ${DIFFROOT} against freshly generated codegen"
+ret=0
+diff -Naupr "${DIFFROOT}/deploy/manifests/00-crds.yaml" "${TMP_DIFFROOT}/deploy/manifests/00-crds.yaml" || ret=$?
+if [[ $ret -eq 0 ]]
+then
+  echo "${DIFFROOT} up to date."
+else
+  echo "${DIFFROOT} is out of date. Please run 'bazel run //hack:update-${RULE_NAME}'"
+  exit 1
+fi