<p>I've been trying to implement a network policy on my cluster (k8s bare-metal) and no policies seem to be implemented on pods running on cluster nodes, only on pods running directly on the master.</p>
<p>What I've tried:</p>
<ul>
<li>A single namespace with a master+node and calico CNI with calicoctl with k8s datastore (I can see the calico/calicoctl containers running on both nodes)</li>
<li>Both networkPolicy types (networking.k8s.io/v1 &amp; projectcalico.org/v3)</li>
<li>Applying a simple deny any ingress/egress policy and testing ping to 8.8.8.8 (pod on master gets blocked, pods on other nodes can still ping)</li>
</ul>
<p>Appreciate your help</p>

Daniel
<p>Found the problem was with the deployment where I've used 'hostNetwork' which uses a subnet that is not part of the pod network (thus Calico is unaware of).</p>
<p>Removing the 'hostNetwork: true' param made the container get a suitable IP and network policies applied to it.</p>
