Did some digging tonight. I got a test program running in my k8s cluster which is watching a configmap that I can change. Added a bunch of print statements everywhere.

I discovered that when it's trying to read the length from the stream the first 4 bytes are "k8s\0". This is the magic number when receiving an individual response. So it seems like k8s is not sending back length prefixed responses when trying to watch a single resource.

func (w *watcherPB) next() (*versioned.Event, *runtime.Unknown, error) {
	length := make([]byte, 4)
	if _, err := io.ReadFull(w.r, length); err != nil {
		return nil, nil, err
	}
	body := make([]byte, int(binary.BigEndian.Uint32(length)))
	if _, err := io.ReadFull(w.r, body); err != nil {
		return nil, nil, fmt.Errorf("read frame body: %v", err)
	}

I printed the URL I was trying to fetch.

https://10.0.0.1:443/api/v1/namespaces/default/configmaps/fe-cm?watch=true

This looks right to me. My config map is in the "default" namespace and it's called "fe-cm".

I don't know the root cause of the problem yet.