failsafe+testng run tests that are not explicitly marked with the group name when I request to only run the group - maven

Question

I marked only 1 test class with "http-integration-test" group:
#Test(groups = "http-integration-test", timeOut = 60_000)
public class MyIT
and then ran "mvn clean integration-test". I see multiple tests are run, not just those from this particular class.
why does failsafe maven plugin + testng combination ignore the request to only run "http-integration-test" group?
my pom.xml :
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<forkCount>1</forkCount>
<reuseForks>false</reuseForks>
<argLine>-ea -Xmx256m</argLine>
</configuration>
</plugin>
<plugin>
<artifactId>maven-failsafe-plugin</artifactId>
<version>2.19.1</version>
<configuration>
<groups>http-integration-test</groups>
<includes>
<include>**/*IntegrationTest.java</include>
<include>**/*IT.java</include>
<include>**/IT*.java</include>
<include>**/TestServerConfigurator.java</include>
<include>*</include>
</includes>
</configuration>
<executions>
<execution>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
and here's the parent pom file section:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.18.1</version>
<!-- the default configuration of surefire executes unit
tests implemented using JUnit. please see http://maven.apache.org/plugins/maven-surefire-plugin/test-mojo.html
for details on these options -->
<configuration>
<!-- -XX:UseSplitVerifier: use legacy class verification; required until javassist can be updated to >= 3.18.2-GA -->
<argLine>-XX:-UseSplitVerifier -XX:MaxPermSize=512m</argLine>
<!-- disable execution of TestNG in case there are both
JUnit and TestNG tests available for execution -->
<testNGArtifactName>none:none</testNGArtifactName>
<excludes>
<!-- Integration Tests end in *IntegrationTest, by
convention -->
<exclude>**/*IntegrationTest.class</exclude>
<exclude>**/*IntegrationTestSuite.class</exclude>
</excludes>
<includes>
<!-- Unit Tests should end in *Test, by convention -->
<include>**/*Test.java</include>
<!-- Include *TestCase, because there are a large
number of tests named this way -->
<include>**/*TestCase.java</include>
</includes>
</configuration>
</plugin>