diff --git a/hack/boilerplate.go.txt b/hack/boilerplate.go.txt
new file mode 100644
index 00000000..422671ea
--- /dev/null
+++ b/hack/boilerplate.go.txt
@@ -0,0 +1,4 @@
+/*
+Copyright 2020 VMware, Inc.
+SPDX-License-Identifier: Apache-2.0
+*/
diff --git a/hack/codegen.sh b/hack/codegen.sh
new file mode 100755
index 00000000..147c505b
--- /dev/null
+++ b/hack/codegen.sh
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 VMware, Inc.
+# SPDX-License-Identifier: Apache-2.0
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+GOPATH="${GOPATH:-$(mktemp -d)}"
+
+K8S_PKG_VERSION="${K8S_PKG_VERSION:-"1.19"}" # TODO: set this in k8s-code-generator-{} image
+CODEGEN_IMAGE=${CODEGEN_IMAGE:-"gcr.io/tanzu-user-authentication/k8s-code-generator-${K8S_PKG_VERSION}:latest"}
+
+BASE_PKG="github.com/suzerain-io/placeholder-name"
+
+function codegen::ensure_module_in_gopath() {
+  local pkg_name="${MOD_DIR/#${ROOT}\//}"
+  local pkg_gosrc_path="${GOPATH}/src/${BASE_PKG}/${pkg_name}"
+
+  if [[ ! -e "${pkg_gosrc_path}" ]]; then
+    mkdir -p "$(dirname "${pkg_gosrc_path}")"
+    ln -s "${ROOT}/${pkg_name}" "${pkg_gosrc_path}"
+  fi
+}
+
+function codegen::invoke_code_generator() {
+  local generator_command="${1}"
+  local mod_basename_for_version="${2}"
+  shift 2 # generator args are now in $@
+
+  if [ "${BASH_VERSINFO[0]}" -lt 5 ]; then
+    echo "ERROR: invalid BASH version"
+    echo "       using    v${BASH_VERSINFO[0]}.${BASH_VERSINFO[1]}.${BASH_VERSINFO[2]} @ ${BASH}"
+    echo "       require  v5.0.0+"
+    exit 1
+  fi
+
+  bash "${GOPATH}/src/k8s.io/code-generator/${generator_command}.sh" \
+    "$@" \
+    --go-header-file "${ROOT}/hack/boilerplate.go.txt" |
+    sed "s|^|${mod_basename_for_version} > ${generator_command} > |"
+}
+
+function codegen::generate_for_module() {
+  local mod_basename_for_version="${1}"
+
+  case "${mod_basename_for_version}" in
+  1.19/api)
+    codegen::invoke_code_generator generate-groups "${mod_basename_for_version}" \
+      deepcopy,defaulter \
+      "${BASE_PKG}/kubernetes/1.19/api/generated" \
+      "${BASE_PKG}/kubernetes/1.19/api/apis" \
+      "placeholder:v1alpha1 crdsplaceholder:v1alpha1"
+    codegen::invoke_code_generator generate-internal-groups "${mod_basename_for_version}" \
+      deepcopy,defaulter,conversion,openapi \
+      "${BASE_PKG}/kubernetes/1.19/api/generated" \
+      "${BASE_PKG}/kubernetes/1.19/api/apis" \
+      "${BASE_PKG}/kubernetes/1.19/api/apis" \
+      "placeholder:v1alpha1 crdsplaceholder:v1alpha1"
+    ;;
+  1.19/client-go)
+    codegen::invoke_code_generator generate-groups "${mod_basename_for_version}" \
+      client,lister,informer \
+      "${BASE_PKG}/kubernetes/1.19/client-go" \
+      "${BASE_PKG}/kubernetes/1.19/api/apis" \
+      "placeholder:v1alpha1 crdsplaceholder:v1alpha1"
+    ;;
+  esac
+}
+
+function codegen::generate() {
+  codegen::ensure_module_in_gopath
+  codegen::generate_for_module "${K8S_PKG_VERSION}/$(basename "${MOD_DIR}")"
+}
+
+function codegen::usage() {
+  echo "Error: <codegen command> must be specified"
+  echo "       ${BASH_SOURCE[0]} <codegen command> [codegen::generate]"
+  exit 1
+}
+
+function codegen::main() {
+  local codegen_command="${1}"
+
+  if [[ -n "${CONTAINED:-}" ]]; then
+    "${codegen_command}"
+  else
+    DOCKER_ROOT_DIR="/tmp/${RANDOM}/${BASE_PKG}"
+    DOCKER_MOD_DIR="${DOCKER_ROOT_DIR}/${MOD_DIR/#${ROOT}\//}"
+
+    docker run --rm \
+      --env CONTAINED=1 \
+      --env MOD_DIR="${DOCKER_MOD_DIR}" \
+      --volume "${ROOT}:${DOCKER_ROOT_DIR}" \
+      --workdir "${DOCKER_MOD_DIR}" \
+      "${CODEGEN_IMAGE}" \
+      "${DOCKER_ROOT_DIR}/hack/$(basename "${BASH_SOURCE[0]}")" \
+      "${codegen_command}"
+  fi
+}
+
+codegen::main "${1:-"codegen::usage"}"
diff --git a/hack/module.sh b/hack/module.sh
index ebea9716..e8b2ff51 100755
--- a/hack/module.sh
+++ b/hack/module.sh
@@ -33,6 +33,10 @@ function unittest_cmd() {
   echo "${cmd} -short -race ./..."
 }
 
+function codegen_cmd() {
+  echo "${ROOT}/hack/codegen.sh codegen::generate"
+}
+
 # The race detector is slow, so sometimes you don't want to use it
 function unittest_no_race_cmd() {
   if [ -x "$(command -v gotest)" ]; then
@@ -62,7 +66,7 @@ function with_modules() {
 
 function usage() {
   echo "Error: <task> must be specified"
-  echo "       do.sh <task> [tidy, lint, test, unittest, unittest_no_race]"
+  echo "       do.sh <task> [tidy, lint, test, unittest, unittest_no_race, codegen]"
   exit 1
 }
 
@@ -73,6 +77,7 @@ function main() {
     'test') with_modules 'test_cmd' ;;
     'unittest') with_modules 'unittest_cmd' ;;
     'unittest_no_race') with_modules 'unittest_no_race_cmd' ;;
+    'codegen') with_modules 'codegen_cmd' ;;
     *) usage ;;
   esac
 }