kubernetes networkpolicy namespaceSelector select when namespace has no labels
What prevents you from creating a new labels for this namespace ?, like this:
kubectl label ns/kube-system calico=enabled
They specifically call that out as a limitation and @Nepomucen has the correct work around solution.
"Targeting of namespaces or services by name (you can, however, target pods or namespaces by their labels, which is often a viable workaround)."