How should rate limiting and WAF integration be designed for production in Ingress?

Use layered controls, trustworthy client identity, sensible thresholds, WAF rules, and observability for blocked traffic. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.