On my network I have several Ubiquity devices: a Unifi Security Gateway, two Unifi APs and a Switch Flex Mini. To control these devices Ubiquity recommendeds to get a Ubiquity Cloud Key or self-host the controller on the same local network. However, I already have a kubernetes managed cluster for some self-hosted services so why get yet another device.

Prerequisites

• Kubernetes cluster
• Terraform with cluster setup
• Helm

I currently use DigitalOcean which offer a managed kubernetes control plane for just the cost of the compute nodes. However most of the major cloud providers now have some managed kubernetes or container service which should also work.

Terraform config

First lets setup terraform with kubernetes and helm providers. Note that I am using the DigitalOcean provider to fetch the kubernetes config as my cluster is already defined in terraform.

provider "kubernetes" {
  host             = digitalocean_kubernetes_cluster.main_cluster.endpoint
  token            = digitalocean_kubernetes_cluster.main_cluster.kube_config[0].token
  cluster_ca_certificate = base64decode(
    digitalocean_kubernetes_cluster.main_cluster.kube_config[0].cluster_ca_certificate
  )
}

provider "helm" {
  kubernetes {
    host     = digitalocean_kubernetes_cluster.main_cluster.endpoint
    token    = digitalocean_kubernetes_cluster.main_cluster.kube_config[0].token
    cluster_ca_certificate = base64decode(
      digitalocean_kubernetes_cluster.main_cluster.kube_config[0].cluster_ca_certificate
    )
  }
}

Next, we will create a namespace and a helm release in the namespace to deploy the unifi helm chart.

resource "kubernetes_namespace" "unifi" {
  metadata {
    name = "unifi"
  }
}

resource "helm_release" "unifi_controller" {
  name       = "unifi"
  repository = "https://k8s-at-home.com/charts"
  chart      = "unifi"
  # Latest version from 'helm search repo unifi'
  version    = "1.5.1"
  namespace  = kubernetes_namespace.unifi.metadata[0].name

  values = [
    file("config/unifi-controller.values.yaml")
  ]
}

Unifi Controller config

Finally we want to setup the config for the unifi controller helm chart.

There are a few caveats with this setup.

The discovery service will not work and does not make sense to, as it will not be on the same LAN anyway. It may be possible to enable by adding some forwarding rules in your router to forward to the service but I have not tested this. It is not too difficult to manually adopt new devices, you can even use the unifi app on the same network to aid with this.

The STUN service will also not work which will cause some delay in device actions as well as the unifi UI to show a warning however there should be no loss in functionality. Both the discovery service and the STUN service are UDP services which my kubernetes provider, DigitalOcean, currently does not support on their load balancers.

Lastly, the captive portal service will also not work, I have not spent much time looking into the issue though as I do not use the feature.

image:
  repository: jacobalberty/unifi
  tag: 6.2.25 # Version of unifi controller image
  pullPolicy: IfNotPresent

# Seperate services
unifiedService:
  enabled: false

# UI service
guiService:
  type: ClusterIP
  port: 8443

# Captive portal service
captivePortalService:
  enabled: false

# Controller service
controllerService:
  type: ClusterIP
  port: 8080
  ingress:
    enabled: false

# STUN service
stunService:
  type: NodePort
  port: 3478 # udp
  # nodePort: 31478

# Discovery service
discoveryService:
  type: NodePort
  port: 10001  # udp
  # nodePort:


ingress:
  enabled: true
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - unifi.example.com
  tls:
   - secretName: unifi-tls
     hosts:
       - unifi.example.com

persistence:
  enabled: true
  accessMode: ReadWriteOnce
  size: 5Gi

The default port for the controller service is 8080 which I ran into a few problems when changing this to use a custom domain and the standard port 80/443 via ingress. To avoid this headache I bypass the ingress config which would expose the service on port 80/443 and instead my cluster nginx ingress controller exposes the port via a tcp service on the special 8080 port on each ingress node.

# https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/ <service:port:PROXY decode:PROXY encode>
tcp:
  8080: "unifi/unifi-controller:controller:PROXY"
  # I have the proxy protocol enabled in digitaloceans load balancer so I have set the decode flag before forwarding traffic to the service

Conclusion

It is possible to run unifi controller in the cloud, for most homes though it probably makes more sense to get a unifi cloud key or run the controller on a Raspberry Pi. Then again if you are reading this you are probably not the average user.