title: Calico CNI networkPolicy not affecting pods running on nodes
body: <p>I've been trying to implement a network policy on my cluster (k8s bare-metal) and no policies seem to be implemented on pods running on cluster nodes, only on pods running directly on the master.</p>
  <p>What I've tried:</p>
  <ul>
  <li>A single namespace with a master+node and calico CNI with calicoctl with k8s datastore (I can see the calico/calicoctl containers running on both nodes)</li>
  <li>Both networkPolicy types (networking.k8s.io/v1 &amp; projectcalico.org/v3)</li>
  <li>Applying a simple deny any ingress/egress policy and testing ping to 8.8.8.8 (pod on master gets blocked, pods on other nodes can still ping)</li>
  </ul>
  <p>Appreciate your help</p>