diff --git a/Makefile b/Makefile
index 01954a475d8..14af422c271 100644
--- a/Makefile
+++ b/Makefile
@@ -132,7 +132,7 @@ check-setup:
 	@which retool >/dev/null 2>&1 || GO111MODULE=off go get github.com/twitchtv/retool
 	@GO111MODULE=off retool sync
 
-check: check-setup lint tidy check-static check-codegen check-terraform check-boilerplate
+check: check-setup lint tidy check-static check-codegen check-terraform check-boilerplate check-openapi-spec check-crd-groups
 
 check-static:
 	@ # Not running vet and fmt through metalinter becauase it ends up looking at vendor
@@ -158,6 +158,12 @@ check-terraform:
 check-boilerplate:
 	./hack/verify-boilerplate.sh
 
+check-openapi-spec:
+	./hack/verify-openapi-spec.sh
+
+check-crd-groups:
+	./hack/verify-crd-groups.sh
+
 # TODO: staticcheck is too slow currently
 staticcheck:
 	@echo "gometalinter staticcheck"
diff --git a/hack/crd-groups.sh b/hack/crd-groups.sh
deleted file mode 100755
index dc8dcca01ea..00000000000
--- a/hack/crd-groups.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2020 PingCAP, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# crd-groups generates crd or verify crd in CI
-
-if [ "$#" -lt 1 ] || [ "${1}" == "--help" ]; then
-  cat <<EOF
-Usage: $(basename $0) <action>
-
-  <action>        the action tu run ( generate, verify )
-
-Examples:
-  $(basename $0) generate
-EOF
-  exit 0
-fi
-
-ACTION="$1"
-shift 1
-
-GO_PKG="github.com/pingcap/tidb-operator"
-CI_GO_PATH="/go"
-scriptdir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-to_crdgen="$scriptdir/../cmd/to-crdgen"
-crd_target="$scriptdir/../manifests/crd.yaml"
-crd_verify_tmp=$(mktemp)
-trap "rm $crd_verify_tmp" EXIT
-
-export GO111MODULE=on
-
-go install k8s.io/code-generator/cmd/openapi-gen
-
-function generate_crd {
-    $1/bin/openapi-gen --go-header-file=$scriptdir/boilerplate/boilerplate.generatego.txt \
-    -i $GO_PKG/pkg/apis/pingcap/v1alpha1,k8s.io/apimachinery/pkg/apis/meta/v1,k8s.io/api/core/v1 \
-    -p apis/pingcap/v1alpha1  -O openapi_generated -o $scriptdir/../pkg
-
-    go install $to_crdgen
-
-	$1/bin/to-crdgen generate tidbcluster > $2
-	$1/bin/to-crdgen generate backup >> $2
-	$1/bin/to-crdgen generate restore >> $2
-	$1/bin/to-crdgen generate backupschedule >> $2
-	$1/bin/to-crdgen generate tidbmonitor >> $2
-	$1/bin/to-crdgen generate tidbinitializer >> $2
-}
-
-if test $ACTION == 'generate' ;then
-	generate_crd $GOPATH $crd_target
-elif [ $ACTION == 'verify' ];then
-
-    if [[ $GOPATH == /go* ]] ;
-    then
-        generate_crd $CI_GO_PATH $crd_verify_tmp
-    else
-        generate_crd $GOPATH $crd_verify_tmp
-    fi
-
-    echo "diffing $crd_target with $crd_verify_tmp" >&2
-	r="$(diff "$crd_target" "$crd_verify_tmp")"
-	if [[ -n $r ]]; then
-		echo $crd_target is not latest
-		exit 1
-	fi
-	echo crds are latest
-fi
diff --git a/hack/update-all.sh b/hack/update-all.sh
new file mode 100755
index 00000000000..2f108888183
--- /dev/null
+++ b/hack/update-all.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+hack/update-codegen.sh
+hack/update-test-codegen.sh
+hack/update-openapi-spec.sh
+hack/update-crd-groups.sh
diff --git a/hack/codegen.sh b/hack/update-codegen.sh
similarity index 97%
rename from hack/codegen.sh
rename to hack/update-codegen.sh
index cdb6e78059c..976c28b2d0a 100755
--- a/hack/codegen.sh
+++ b/hack/update-codegen.sh
@@ -31,5 +31,3 @@ bash "${CODEGEN_PKG}"/generate-groups.sh "deepcopy,client,informer,lister" \
     github.com/pingcap/tidb-operator/pkg/apis \
     pingcap:v1alpha1 \
     --go-header-file ./hack/boilerplate/boilerplate.generatego.txt
-
-./hack/crd-groups.sh generate
diff --git a/hack/update-crd-groups.sh b/hack/update-crd-groups.sh
new file mode 100755
index 00000000000..3f79ab82e24
--- /dev/null
+++ b/hack/update-crd-groups.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+source "${ROOT}/hack/lib.sh"
+
+crd_target="$ROOT/manifests/crd.yaml"
+
+# Ensure that we find the binaries we build before anything else.
+export GOBIN="${OUTPUT_BIN}"
+PATH="${GOBIN}:${PATH}"
+
+# Enable go modules explicilty.
+export GO111MODULE=on
+go install github.com/pingcap/tidb-operator/cmd/to-crdgen
+
+to-crdgen generate tidbcluster > $crd_target
+to-crdgen generate backup >> $crd_target
+to-crdgen generate restore >> $crd_target
+to-crdgen generate backupschedule >> $crd_target
+to-crdgen generate tidbmonitor >> $crd_target
+to-crdgen generate tidbinitializer >> $crd_target
diff --git a/hack/update-openapi-spec.sh b/hack/update-openapi-spec.sh
new file mode 100755
index 00000000000..02312e62068
--- /dev/null
+++ b/hack/update-openapi-spec.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+source "${ROOT}/hack/lib.sh"
+
+# Ensure that we find the binaries we build before anything else.
+export GOBIN="${OUTPUT_BIN}"
+PATH="${GOBIN}:${PATH}"
+
+# Enable go modules explicilty.
+export GO111MODULE=on
+go install k8s.io/code-generator/cmd/openapi-gen
+
+openapi-gen --go-header-file=./hack/boilerplate/boilerplate.generatego.txt \
+    -i github.com/pingcap/tidb-operator/pkg/apis/pingcap/v1alpha1,k8s.io/apimachinery/pkg/apis/meta/v1,k8s.io/api/core/v1 \
+    -p apis/pingcap/v1alpha1 -O openapi_generated -o ./pkg
diff --git a/hack/test-codegen.sh b/hack/update-test-codegen.sh
similarity index 100%
rename from hack/test-codegen.sh
rename to hack/update-test-codegen.sh
diff --git a/hack/verify-all.sh b/hack/verify-all.sh
new file mode 100755
index 00000000000..26007c90b6c
--- /dev/null
+++ b/hack/verify-all.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+make check-setup
+make check
diff --git a/hack/verify-codegen.sh b/hack/verify-codegen.sh
index 06a3e2831ad..6fdd2dcb82c 100755
--- a/hack/verify-codegen.sh
+++ b/hack/verify-codegen.sh
@@ -33,7 +33,7 @@ cleanup
 mkdir -p "${TMP_DIFFROOT}"
 cp -a "${DIFFROOT}"/* "${TMP_DIFFROOT}"
 
-"${ROOT}/hack/codegen.sh"
+"${ROOT}/hack/update-codegen.sh"
 echo "diffing ${DIFFROOT} against freshly generated codegen"
 ret=0
 diff -Naupr "${DIFFROOT}" "${TMP_DIFFROOT}" || ret=$?
@@ -41,8 +41,6 @@ cp -a "${TMP_DIFFROOT}"/* "${DIFFROOT}"
 if [[ $ret -eq 0 ]]; then
   echo "${DIFFROOT} up to date."
 else
-  echo "${DIFFROOT} is out of date. Please run hack/codegen.sh"
+  echo "${DIFFROOT} is out of date. Please run hack/update-codegen.sh"
   exit 1
 fi
-
-${ROOT}/hack/crd-groups.sh verify
diff --git a/hack/verify-crd-groups.sh b/hack/verify-crd-groups.sh
new file mode 100755
index 00000000000..ca6ed42fb3d
--- /dev/null
+++ b/hack/verify-crd-groups.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+target="manifests/crd.yaml"
+verify_tmp=$(mktemp)
+trap "rm -f $verify_tmp" EXIT
+
+cp "$target" "${verify_tmp}"
+
+hack/update-crd-groups.sh
+
+echo "diffing $target with $verify_tmp" >&2
+diff=$(diff "$target" "$verify_tmp") || true
+if [[ -n "${diff}" ]]; then
+    echo "${diff}" >&2
+    echo >&2
+    echo "Run ./hack/update-crd-groups.sh" >&2
+    exit 1
+fi
diff --git a/hack/verify-openapi-spec.sh b/hack/verify-openapi-spec.sh
new file mode 100755
index 00000000000..bd23bd974c0
--- /dev/null
+++ b/hack/verify-openapi-spec.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 PingCAP, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/.. && pwd)
+cd $ROOT
+
+target="pkg/apis/pingcap/v1alpha1/openapi_generated.go"
+verify_tmp=$(mktemp)
+trap "rm -f $verify_tmp" EXIT
+
+cp "$target" "${verify_tmp}"
+
+hack/update-openapi-spec.sh
+
+echo "diffing $target with $verify_tmp" >&2
+diff=$(diff "$target" "$verify_tmp") || true
+if [[ -n "${diff}" ]]; then
+    echo "${diff}" >&2
+    echo >&2
+    echo "Run ./hack/update-openapi-spec.sh" >&2
+    exit 1
+fi