<p>I am trying to add a calico network policy to allow my namespace to talk to kube-system namespace. But in my k8s cluster kube-system has no labels attached to it, so I am not able to select pods in there. Below is what I tried but its not working.</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-kube-system
  namespace: advanced-policy-demo
spec:
  podSelector: {}       # select all pods in current namespace.
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels: {}
      podSelector:
        matchLabels:
          tier: control-plane
  egress:
  - to:
    - namespaceSelector:
        matchLabels: {}
      podSelector:
        matchLabels:
          tier: control-plane
</code></pre>

<pre><code>$ kubectl describe ns kube-system
Name:         kube-system
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Status:       Active

No resource quota.

No resource limits.
</code></pre>

<p>I there a way by which I can select a namespace by its name only?</p>

<p>What prevents you from creating a new labels for this namespace ?, like this:</p>

<pre><code>kubectl label ns/kube-system calico=enabled
</code></pre>
