Lattice is IPAM + DHCP first. Everything else is an adapter: after a lease is committed (or an IPAM object changes), a worker talks to a system you already run. dhcpd never waits on those systems. Ack is not delayed. A broken adapter is an incident on Work → DNS (or a webhook retry), not a DHCP outage.
This page is the map. Each child page teaches what the other system is doing, why Lattice needs credentials, and how to mint them.
If you administer Windows / AD and not Linux, read windows-admin first (SSH, WinSCP, chmod). Relays (ip helper-address): relays. How a laptop finds DNS: dns-how.
Vendor UIs and flags change. Each child page links the current official documentation; use those pages for the latest Microsoft / ISC / PowerDNS / NetBox steps, and this hub for what Lattice expects. Long how-tos start with Just show me the steps, which jumps to commands at the bottom of that page.
| You already run | Lattice talks to it as | Lattice doc | Vendor docs (latest steps) |
|---|---|---|---|
| Active Directory DNS | GSS-TSIG (nsupdate -g) after Ack | ad-ddns | ktpass · DNS dynamic update |
| BIND (or BIND-compatible) | RFC 2136 + TSIG | bind-ddns | BIND 9 ARM · tsig-keygen |
| PowerDNS Authoritative | HTTP API PATCH rrsets | powerdns | HTTP API · Zones |
| Nothing — Lattice should be the zone | lattice-dns + optional hidden-primary AXFR | dns, dns-how | — |
| A CMDB (NetBox) | Prefix export / create-missing import | netbox | REST API · Prefix |
| An orchestrator / SIEM | Signed HTTPS webhooks | webhooks | HMAC is RFC 2104; your receiver’s docs (not Lattice) |
| Operator login (not DNS) | OIDC | Console Settings | Microsoft Entra ID (OIDC) · Okta · AD FS |
1. Why DNS integration exists at all
DHCP and DNS are two databases that must agree:
- DHCP knows this MAC just received 10.20.20.55.
- People and other hosts look up printer-01.office.example.com.
Someone has to write the A (and PTR) after Ack, and delete them after release or expiry. Microsoft DHCP did that with “dynamic DNS” and a credential on the DHCP server. ISC dhcpd did it with nsupdate and a TSIG key. Lattice does the same job in the worker, from an outbox row, through one adapter per zone.
What Lattice does not do:
- Become the recursive resolver the laptop uses for the internet.
- Host the AD forest (
ad.example.com,_msdcs). - Join the domain, talk LDAP, or log anyone into the console as part of DDNS.
The laptop still uses DHCP option 6. That list is almost always the DCs, Unbound, or BIND — not lattice-dns. Education: dns-how.
2. Pick one writer per zone
| Zone | Typical writer | Adapter |
|---|---|---|
ad.example.com, _msdcs | Domain controllers | ad_gsstsig for other names you want Lattice to register; never embedded for the forest |
office.example.com you already host on BIND | BIND | bind_tsig |
| Same idea on PowerDNS Auth | PowerDNS | powerdns_http |
| A new internal zone only Lattice should own | lattice-dns (often hidden primary, BIND secondaries) | embedded |
Do not set embedded and bind_tsig / ad_gsstsig / powerdns_http on the same zone. Two writers, two serials, split brain.
ad_gsstsig is allowed on every entitlement tier, including community. HA is the paid wall, not AD DDNS.
3. Where you click / POST
- More → DDNS adapters (
/dns-servers) — onedns_serverrow per remote system. Admin. Secrets are refs, never shown again. - On each subnet (Settings tab):
ddns_enabled,ddns_adapter(the adapter name),ddns_forward_zone,ddns_reverse_zone. - DHCP option 6 on that subnet: the resolvers clients already use (usually DCs). Enabling DDNS does not set option 6.
API: POST /api/v1/dns-servers, then PATCH /api/v1/subnets/{id}.
4. Secret refs
Adapters need a keytab, a TSIG secret, or an API key. Lattice stores a pointer, not the bytes, in Postgres:
| Ref | Meaning |
|---|---|
env:NAME | Worker process environment (letters, digits, _, .) |
file:/absolute/path | File on the worker host. Must be absolute. Mode 0600. |
NAME | Env NAME, else $LATTICE_SECRET_DIR/NAME (filename only, no .. or slashes) |
The API never returns the secret after create. Put the file or env on every host that runs lattice-worker (HA: all three control nodes). dhcpd does not read these refs.
Keytabs are files (file:/etc/lattice/lattice.keytab). The worker needs a path on disk for nsupdate -g. Do not paste keytab bytes into the IPAM UI. Minting a keytab is ad-ddns §4 (ktpass / samba-tool). A TSIG secret is bind-ddns §3 (tsig-keygen).
5. Failure mode (same for every adapter)
Grant commits in Postgres. The worker then upserts DNS. If Kerberos, BIND, or PowerDNS is down:
- The lease stays.
- The outbox row retries with backoff, then
failed. - Work → DNS is the queue. Replay is operator+.
- Overview lag is
lattice_outbox_lag.
That is intentional. A DC outage must not take DHCP down.
6. Read next
Start with dns-how if option 6 / stubs / “why isn’t lattice-dns my resolver?” is unclear. Then the adapter page for the system you actually have.