<p>I am using service mesh <a href="https://istio.io/" rel="noreferrer">https://istio.io/</a> installed on top of kubernetes and have installed 
the example <a href="https://istio.io/docs/examples/bookinfo/" rel="noreferrer">https://istio.io/docs/examples/bookinfo/</a>, that ISTIO provides on their website. </p>

<p>Assume, I've created a service <strong>FOO</strong> and would like to call the service <strong>ratings</strong> through the virtual service <strong>ratings</strong>.  </p>

<p><a href="https://i.stack.imgur.com/Z7uIY.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Z7uIY.png" alt="enter image description here"></a></p>

<ul>
<li><p>How to call <strong>ratings</strong> within <strong>FOO</strong>? Which address do I have to
provide the http client in the <strong>FOO</strong> service to call <strong>ratings</strong>. Do 
Ihave to create a virtual service for <strong>ratings</strong>? <strong>ratings</strong> should 
not be accessible outside of kubernetes cluser.  </p></li>
<li><p>When <strong>FOO</strong> calls <strong>ratings</strong>, will the request go first through the 
own envoy proxy or it goes directly to <strong>ratings</strong> envoy proxy?</p></li>
</ul>

<p><strong>Follow-up question</strong></p>

<p>Here are all virtual services installed on the kubernetes cluster: </p>

<p>[<img src="https://i.stack.imgur.com/I5etw.jpg" alt="enter image description here"><a href="https://i.stack.imgur.com/I5etw.jpg" rel="noreferrer">2</a></p>

<p>The cluster IP address is: </p>

<p><a href="https://i.stack.imgur.com/R1q8p.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/R1q8p.jpg" alt="enter image description here"></a></p>

<p>The question is, how can I call the <strong>ratings</strong> service in <strong>FOO</strong> service? With the <strong>Cluster IP</strong> address?</p>

softshipper
<blockquote>
<p>How to call RATINGS within FOO? Which address do I have to provide the http client in the FOO service to call RATINGS. Do I have to create a virtual service for RATINGS? RATINGS should not be accessible outside of kubernetes cluster.</p>
</blockquote>
<p>You can still call other services the same way you would without istio. Since the service only needs to be accessible inside the cluster, you'll want to expose it with a <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="noreferrer">clusterIP service</a>. You can then call the service by name using <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/" rel="noreferrer">Kubernetes DNS</a>. In general, the service is available at <code>http(s)://{namespace}.{service-name}</code>. To call a service in the same namespace, you can leave the <code>{namespace}</code> out of the url.</p>
<p>While it is not necessary to create a VirtualService, <a href="https://istio.io/docs/ops/best-practices/traffic-management/#set-default-routes-for-services" rel="noreferrer">it is advised by istio</a>:</p>
<blockquote>
<p>Although the default Istio behavior conveniently sends traffic from
any source to all versions of a destination service without any rules
being set, creating a VirtualService with a default route for every
service, right from the start, is generally considered a best practice
in Istio.</p>
</blockquote>
<blockquote>
<p>When FOO calls RATINGS, will the request go first through the own envoy proxy or it goes directly to RATINGS envoy proxy?**</p>
</blockquote>
<p>It will go through both envoy proxies. This is how istio can manage the routing of your requests and provide traffic insights like tracing.</p>
<p>The outbound envoy proxy can be bypassed though, with the <a href="https://istio.io/docs/tasks/traffic-management/egress/egress-control/#direct-access-to-external-services" rel="noreferrer">traffic.sidecar.istio.io/includeOutboundIPRanges annotation</a>.</p>
