Summary

First of all, great effort and wonderful plugin. Gives us most of the features we are looking for out the box which are missing the OSS version.

There can be a log only mode which can help in deciding the scale and limits before actually starting to rate-limit the requests. It would be beneficial incase of first implementation where we can start the plugin in log only/audit only mode. And then refer the metrics before enforcing the rate-limiting rules.

Also, would be very much helpful if we can add an audit trail to figure out how many requests were rate-limited, and say when limiting on basis of any header eg. User-id, we can check out which particular user-ids were rate-limited and the number of requests. Though, this metric can be extracted out via plotting the 429's but that would a holistic view only. If we can log the ids or publish any time series metrics to plot it easily using prometheus that would be very helpful.