Cisco's Head of Open Source Stephen Augustus has been thinking a lot about the intersection of observability and security, he told SDxCentral.

But the initial conversation starts with monitoring and how the industry is evolving past it. "In monitoring, you have this assumed set of well-behaved processes or expectations that you can build dashboards against and see what's happening day to day," he explained. Looking at a red bar or a green bar is a simple way to see if everything is meeting expectations.

Now the industry is moving past simple monitoring toward observability, Augustus said. This means "we respect the fact that software is in its running state is unpredictable."

This is especially true for cloud-native applications that shifted the paradigm of how software is delivered. And cloud-native software overall is hard to introspect on any one component without instrumenting it, he explained.

"Observability starts to say, 'Let's respect the fact that the running state of this cluster, the set of clusters, these multiple environments is fluid, and it's going to evolve over time,'" he said, adding that the same can be said for security.

To that point, Cisco has been building open source tools "that marry that respect for this evolving state of the landscape of the running environments with the fact that the same is true for security," he noted.

Last October Cisco announced its first open source tool meant to provide advanced observability for APIs. APIClarity allows developers to introspect the running state of applications and understand how APIs are interacting with one another.

Now Cisco is promoting its work on KubeClarity, an open source tool that complements APIClarity and falls under the networking giant's growing OpenClarity umbrella.

KubeClarity provides detection and management of software bill of materials (SBOM) and vulnerabilities in container images and filesystems, according to the vendor. The tool also scans Kubernetes clusters in runtime, further securing the software supply chain.

"How do we get those into production in a safe way? And how do we observe this entire system as that's happening? APIClarity and KubeClarity are merely two components of that," Augustus said.

Augustus said his team decided on the name Clarity as the link between these products because, "It kind of says what's on the tin, you know, for better or worse. We want to bring clarity on the open source side into what's happening in your environments," whether that's good news or bad, he explained.

Running APIs, their interactions with other components, deployment to Kubernetes clusters, and everything that's happening up to that stage is another component that needs to be observed and secured, Augustus said. "And OpenClarity is essentially the umbrella for that."

By creating this umbrella, over time Cisco will be able to open the door to talk about "the clarity of your data, the clarity of your virtual machines, and so on," he said.