// Module included in the following assemblies:
//
// backup_and_restore/application_backup_and_restore/oadp-vmfr/oadp-vmfr.adoc
// virt/backup_restore/virt-recovering-individual-files-from-vm-backups.adoc

:_mod-docs-content-type: CONCEPT
[id="oadp-vmfr-security_{context}"]
= {oadp-short} VMFR security considerations

[role="_abstract"]
Review the security considerations for {oadp-short} virtual machine file restore (VMFR) to understand how access control, data protection, and multi-tenancy are managed. This helps you to plan secure file-level restore operations.

Access control::
VMFR enforces the following access control policies:
+
--
* File-serving resources are created in a temporary namespace that is separate from the {oadp-short} namespace. This namespace is owned by the `VirtualMachineFileRestore` CR and is cleaned up automatically when you delete the CR.
* The discovery controller requires read-only access to Velero `Backup` resources.
* The file restore controller requires create and delete access for namespaces, pods, services, and PVCs.
* Cluster administrators require create, read, update, and delete access to `VirtualMachineBackupsDiscovery` and `VirtualMachineFileRestore` resources in the {oadp-short} namespace.
* Controllers authenticate to object storage by using the Velero backup storage location credentials. Controllers have read-only access to backup data and never modify backups.
--

Data protection::
VMFR protects data in transit by using the following mechanisms:
+
--
* Web browser access uses HTTPS endpoints with TLS certificates.
* SSH access uses auto generated key pairs.
* Credentials are stored in Kubernetes secrets.
--

Multi-tenancy::
VMFR supports multi-tenancy through namespace isolation:
+
--
* Multiple `VirtualMachineFileRestore` resources can exist simultaneously. Each resource creates an isolated temporary namespace.
* Resources from different restores cannot interfere with each other.
* You can restore the same VM from different backups in parallel.
* Temporary namespace names are derived from the `VirtualMachineFileRestore` resource name, and PVC names in the temporary namespace use the backup name as a suffix to prevent naming conflicts.
--
