diff --git a/.github/codecov.yml b/.github/codecov.yml
new file mode 100644
index 0000000000..729bb67495
--- /dev/null
+++ b/.github/codecov.yml
@@ -0,0 +1,12 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
diff --git a/.github/workflows/cover.yaml b/.github/workflows/cover.yaml
new file mode 100644
index 0000000000..7a977b055c
--- /dev/null
+++ b/.github/workflows/cover.yaml
@@ -0,0 +1,31 @@
+name: codecov
+
+on:
+  pull_request:
+  push:
+    branches:
+    - main
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version: '1.20'
+    - run: "PATH=/usr/local/go/bin:$PATH make test-cover"
+    - uses: Wandalen/wretry.action@a163f62ae554a8f3cbe27b23db15b60c0ae2e93c # v1.3.0 Retry codecov upload. It is flaky due to a known issue https://community.codecov.com/t/upload-issues-unable-to-locate-build-via-github-actions-api/3954
+      with:
+        attempt_limit: 20
+        action: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
+        with: |
+          file: ./coverage.out
+          fail_ci_if_error: true
diff --git a/Makefile b/Makefile
index 3b108a3a3a..7919d4d858 100644
--- a/Makefile
+++ b/Makefile
@@ -471,6 +471,7 @@ test-junit: $(SETUP_ENVTEST) $(GOTESTSUM) $(GOVC) ## Run unit tests
 .PHONY: test-cover
 test-cover: ## Run unit tests and generate a coverage report
 	$(MAKE) test TEST_ARGS="$(TEST_ARGS) -coverprofile=coverage.out"
+	./hack/codecov-ignore.sh
 	go tool cover -func=coverage.out -o coverage.txt
 	go tool cover -html=coverage.out -o coverage.html
 
diff --git a/hack/codecov-ignore.sh b/hack/codecov-ignore.sh
new file mode 100755
index 0000000000..9f0eff592c
--- /dev/null
+++ b/hack/codecov-ignore.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+# Copyright 2023 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Ignore generated files in API packages, e.g. zz_generated.deepcopy.go and zz_generated.conversion.go.
+{
+  find apis -regex '.*zz_generated.*\.go' -exec echo sigs.k8s.io/cluster-api-provider-vsphere/{} \;
+} >> codecov-ignore.txt
+
+while read -r p || [ -n "$p" ] 
+do
+if [[ "${OSTYPE}" == "darwin"* ]]; then
+  sed -i '' "/${p//\//\\/}/d" ./coverage.out
+else
+  sed -i "/${p//\//\\/}/d" ./coverage.out
+fi
+done < ./codecov-ignore.txt