diff --git a/build/root/Makefile.generated_files b/build/root/Makefile.generated_files
index 58546e87582..59372a0c305 100644
--- a/build/root/Makefile.generated_files
+++ b/build/root/Makefile.generated_files
@@ -35,7 +35,7 @@ SHELL := /bin/bash
 # This rule collects all the generated file sets into a single rule.  Other
 # rules should depend on this to ensure generated files are rebuilt.
 .PHONY: generated_files
-generated_files: gen_deepcopy gen_defaulter gen_conversion gen_openapi
+generated_files: gen_deepcopy gen_defaulter gen_conversion gen_openapi gen_bindata
 
 .PHONY: verify_generated_files
 verify_generated_files: verify_gen_deepcopy    \
@@ -805,3 +805,64 @@ sinclude $(META_DIR)/$(OPENAPI_GEN).mk
 $(OPENAPI_GEN):
 	hack/make-rules/build.sh ./vendor/k8s.io/code-generator/cmd/openapi-gen
 	touch $@
+
+#
+# bindata generation
+#
+
+# The tool used to generate bindata files.
+BINDATA_GEN := $(BIN_DIR)/go-bindata
+
+# A wrapper script that generates all bindata files.  It is fast enough that we
+# don't care.
+BINDATA_SCRIPT := hack/generate-bindata.sh
+
+# This rule is the user-friendly entrypoint for bindata generation.
+.PHONY: gen_bindata
+gen_bindata: $(BINDATA_GEN) FORCE
+	./hack/run-in-gopath.sh $(BINDATA_SCRIPT)
+
+FORCE:
+
+# This calculates the dependencies for the generator tool, so we only rebuild
+# it when needed.  It is PHONY so that it always runs, but it only updates the
+# file if the contents have actually changed.  We 'sinclude' this later.
+.PHONY: $(META_DIR)/$(BINDATA_GEN).mk
+$(META_DIR)/$(BINDATA_GEN).mk:
+	mkdir -p $(@D);                                                       \
+	(echo -n "$(BINDATA_GEN): ";                                          \
+	 ./hack/run-in-gopath.sh go list                                      \
+	     -f '{{.ImportPath}}{{"\n"}}{{range .Deps}}{{.}}{{"\n"}}{{end}}'  \
+	     ./vendor/github.com/jteeuwen/go-bindata/go-bindata               \
+	     | grep --color=never "^$(PRJ_SRC_PATH)/"                         \
+	     | xargs ./hack/run-in-gopath.sh go list                          \
+	         -f '{{$$d := .Dir}}{{$$d}}{{"\n"}}{{range .GoFiles}}{{$$d}}/{{.}}{{"\n"}}{{end}}'  \
+	     | paste -sd' ' -                                                 \
+	     | sed 's/ / \\=,/g'                                              \
+	     | tr '=,' '\n\t'                                                 \
+	     | sed "s|$$(pwd -P)/||";                                         \
+	) > $@.tmp;                                                           \
+	if ! cmp -s $@.tmp $@; then                                           \
+	    if [[ "$(DBG_CODEGEN)" == 1 ]]; then                              \
+	        echo "DBG: $(BINDATA_GEN).mk changed";                        \
+	    fi;                                                               \
+	    cat $@.tmp > $@;                                                  \
+	    rm -f $@.tmp;                                                     \
+	fi
+
+# Include dependency info for the generator tool.  This will cause the rule of
+# the same name to be considered and if it is updated, make will restart.
+sinclude $(META_DIR)/$(BINDATA_GEN).mk
+
+# How to build the generator tool.  The deps for this are defined in
+# the $(BINDATA_GEN).mk, above.
+#
+# A word on the need to touch: This rule might trigger if, for example, a
+# non-Go file was added or deleted from a directory on which this depends.
+# This target needs to be reconsidered, but Go realizes it doesn't actually
+# have to be rebuilt.  In that case, make will forever see the dependency as
+# newer than the binary, and try to rebuild it over and over.  So we touch it,
+# and make is happy.
+$(BINDATA_GEN):
+	hack/make-rules/build.sh ./vendor/github.com/jteeuwen/go-bindata/go-bindata
+	touch $@
diff --git a/hack/generate-bindata.sh b/hack/generate-bindata.sh
index 6d2ec0a5d71..a0545d11cfe 100755
--- a/hack/generate-bindata.sh
+++ b/hack/generate-bindata.sh
@@ -18,10 +18,8 @@ set -o errexit
 set -o pipefail
 set -o nounset
 
-if [[ -z "${KUBE_ROOT:-}" ]]; then
-	KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
-fi
-
+export KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
 
 if [[ ! -d "${KUBE_ROOT}/examples" ]]; then
@@ -31,7 +29,7 @@ fi
 
 # kube::golang::build_kube_toolchain installs the vendored go-bindata in
 # $GOPATH/bin, so make sure that's explicitly part of our $PATH.
-export PATH="${GOPATH}/bin:${PATH}"
+export PATH="${KUBE_OUTPUT_BINPATH}:${PATH}"
 
 if ! which go-bindata &>/dev/null ; then
 	echo "Cannot find go-bindata."
diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index e28492bd822..9e2c3d92d08 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -213,11 +213,6 @@ readonly KUBE_STATIC_LIBRARIES=(
   kubectl
 )
 
-# Add any files with those //generate annotations in the array below.
-readonly KUBE_BINDATAS=(
-  test/e2e/generated/gobindata_util.go
-)
-
 kube::golang::is_statically_linked_library() {
   local e
   for e in "${KUBE_STATIC_LIBRARIES[@]}"; do [[ "$1" == *"/$e" ]] && return 0; done;
@@ -417,25 +412,6 @@ kube::golang::place_bins() {
   done
 }
 
-# Builds the toolchain necessary for building kube. This needs to be
-# built only on the host platform.
-# TODO: Find this a proper home.
-# Ideally, not a shell script because testing shell scripts is painful.
-kube::golang::build_kube_toolchain() {
-  local targets=(
-    vendor/github.com/jteeuwen/go-bindata/go-bindata
-  )
-
-  local binaries
-  binaries=($(kube::golang::binaries_from_targets "${targets[@]}"))
-
-  kube::log::status "Building the toolchain targets:" "${binaries[@]}"
-  go install "${goflags[@]:+${goflags[@]}}" \
-        -gcflags "${gogcflags}" \
-        -ldflags "${goldflags}" \
-        "${binaries[@]:+${binaries[@]}}"
-}
-
 # Try and replicate the native binary placement of go install without
 # calling go install.
 kube::golang::outfile_for_binary() {
@@ -590,18 +566,6 @@ kube::golang::build_binaries() {
       fi
     fi
 
-    # First build the toolchain before building any other targets
-    kube::golang::build_kube_toolchain
-
-    kube::log::status "Generating bindata:" "${KUBE_BINDATAS[@]}"
-    for bindata in "${KUBE_BINDATAS[@]}"; do
-      # Only try to generate bindata if the file exists, since in some cases
-      # one-off builds of individual directories may exclude some files.
-      if [[ -f "${KUBE_ROOT}/${bindata}" ]]; then
-        go generate "${goflags[@]:+${goflags[@]}}" "${KUBE_ROOT}/${bindata}"
-      fi
-    done
-
     if [[ "${parallel}" == "true" ]]; then
       kube::log::status "Building go targets for {${platforms[*]}} in parallel (output will appear in a burst when complete):" "${targets[@]}"
       local platform
diff --git a/hack/verify-typecheck.sh b/hack/verify-typecheck.sh
index bd55f592961..a5da12c6da2 100755
--- a/hack/verify-typecheck.sh
+++ b/hack/verify-typecheck.sh
@@ -25,9 +25,7 @@ kube::golang::verify_go_version
 
 cd "${KUBE_ROOT}"
 
-if [[ ! -f test/e2e/generated/bindata.go ]]; then
-  make --no-print-directory -C "${KUBE_ROOT}" verify_generated_files
-fi
+make --no-print-directory -C "${KUBE_ROOT}" generated_files
 
 ret=0
 go run test/typecheck/main.go "$@" || ret=$?
diff --git a/test/e2e/generated/gobindata_util.go b/test/e2e/generated/gobindata_util.go
index 0d939dd53b5..62e031d9802 100644
--- a/test/e2e/generated/gobindata_util.go
+++ b/test/e2e/generated/gobindata_util.go
@@ -16,8 +16,6 @@ limitations under the License.
 
 package generated
 
-//go:generate ../../../hack/generate-bindata.sh
-
 import "github.com/golang/glog"
 
 /*