@@ -80,7 +80,9 @@ kubectl get events -A --field-selector reportingComponent=spark-kubernetes-opera
 ```
 
 Whenever a resource transitions into a new state, the operator publishes an event whose `reason`
-is the name of the new state and whose `message` is the state message. Repeated transitions into
+is the name of the new state and whose `message` is the state message, except that the event of
+`SchedulingFailure` leaves out the stack trace of the failure, see
+[Event messages](#event-messages). Repeated transitions into
 the same state are aggregated into a single `Event` object by incrementing its `count` and
 replacing its `message`. A repeat carrying the same `message` may be paced by
 [`minIntervalSeconds`](#event-frequency), while one carrying a new `message` is always published.
@@ -189,6 +191,29 @@ still holds the interval. An event which is republished, such as `SuspendHeld` o
 a failure which lasts, recovers with its next repeat after the interval, while one which is not,
 such as a state transition, is lost; the resource status remains the source of truth.
 
+### Event messages
+
+The `message` of a `Warning` event about an error, such as `ReconcileError` or
+`ClusterRequestFailed`, describes the exception and its innermost cause, without the stack trace,
+which the operator logs. For a request which the API server rejected, it is the message of the API
+server, as in the events of the built-in controllers, e.g. an RBAC denial which names the
+ServiceAccount of the operator, a rejection by an admission webhook or a resource quota, or a field
+value which the API server found invalid. When `SchedulingFailure` is caused by an exception, its
+event describes the exception alike, while its state message keeps the stack trace.
+
+Events reach more readers than the status of the resources. The built-in `view`, `edit` and
+`admin` ClusterRoles grant reading the `events` of a namespace, but not the `SparkApplication` and
+`SparkCluster` resources, which the Helm chart does not aggregate into them, and event exporters
+often forward warnings out of the cluster, e.g. to chat or logging services. So keep credentials
+out of `spec.sparkConf` and pod templates, since an error may quote them, e.g. as an invalid value,
+and refer to Kubernetes Secrets instead, e.g. with `spark.kubernetes.driver.secretKeyRef.[EnvName]`
+and `spark.kubernetes.executor.secretKeyRef.[EnvName]`. To keep the details of failures in the
+resource status and the operator log only, exclude their reasons, e.g. as follows.
+
+```properties
+spark.kubernetes.operator.events.excludedReasons=SchedulingFailure,ReconcileError,CleanupError,StatusUpdateFailed,ClusterRequestFailed,SuspendReleaseFailed,Kueue.*Failed
+```
+
 ## Metrics
 
 Spark operator,
 
@@ -52,6 +52,7 @@
 import org.apache.spark.k8s.operator.status.ApplicationState;
 import org.apache.spark.k8s.operator.status.ApplicationStateSummary;
 import org.apache.spark.k8s.operator.status.ApplicationStatus;
+import org.apache.spark.k8s.operator.utils.EventUtils;
 import org.apache.spark.k8s.operator.utils.ReconcilerUtils;
 import org.apache.spark.k8s.operator.utils.SparkAppStatusRecorder;
 
@@ -162,8 +163,15 @@ public ReconcileProgress reconcile(
               .getStatus()
               .appendNewState(
                   new ApplicationState(ApplicationStateSummary.SchedulingFailure, errorMessage));
-      return attemptStatusUpdate(
-          context, statusRecorder, updatedStatus, completeAndImmediateRequeue());
+      // The status keeps the stack trace, while the event, which reaches more readers, only
+      // describes the failure, like the other warning events.
+      if (!statusRecorder.persistStatus(
+          context,
+          updatedStatus,
+          Constants.SCHEDULE_FAILURE_MESSAGE + " " + EventUtils.describe(e))) {
+        log.warn("Failed to persist status, will retry status update in next reconcile attempt");
+      }
+      return completeAndImmediateRequeue();
     }
     ApplicationStatus updatedStatus =
         context
 
@@ -199,12 +199,15 @@ private ReconcileProgress failScheduling(
       log.error("Failed to request master resource.", e);
     }
     String msg = CLUSTER_SCHEDULE_FAILURE_MESSAGE + " StackTrace: " + buildGeneralErrorMessage(e);
+    // The status keeps the stack trace, while the event, which reaches more readers, only
+    // describes the failure, like the other warning events.
     statusRecorder.persistStatus(
         context,
         context
             .getResource()
             .getStatus()
-            .appendNewState(new ClusterState(SchedulingFailure, msg)));
+            .appendNewState(new ClusterState(SchedulingFailure, msg)),
+        CLUSTER_SCHEDULE_FAILURE_MESSAGE + " " + EventUtils.describe(e));
     return completeAndImmediateRequeue();
   }
 
 
@@ -21,6 +21,7 @@
 
 import java.util.Set;
 
+import io.fabric8.kubernetes.client.KubernetesClientException;
 import io.javaoperatorsdk.operator.api.event.EventRecord;
 import io.javaoperatorsdk.operator.api.event.EventType;
 import io.javaoperatorsdk.operator.api.event.ResourceEventRecorder;
@@ -146,8 +147,8 @@ public static EventType eventTypeOf(BaseStateSummary summary) {
    * <p>The reason doubles as the event key, so repeated warnings for the same reason on the same
    * resource collapse into a count increment on a single Event object instead of creating one
    * Event per occurrence. Messages therefore must not be part of the identity: they typically vary
-   * between attempts, for instance because a {@code KubernetesClientException} message embeds the
-   * request URL.
+   * between attempts, for instance because a rejection by a resource quota reports its current
+   * usage.
    *
    * @param recorder The event recorder bound to the resource.
    * @param reason A short CamelCase reason, as expected by Kubernetes.
@@ -193,8 +194,14 @@ public static void record(
   /**
    * Builds a concise single-line description of an exception, suitable for an event message. The
    * innermost cause is appended when the exception has one, since that is usually where the
-   * actionable detail is. The full stack trace is intentionally omitted, it belongs in the
-   * operator log.
+   * actionable detail is, unless its message is the same. The full stack trace is intentionally
+   * omitted, it belongs in the operator log.
+   *
+   * <p>A request which the API server answered with an error is described by the message of the
+   * returned {@code Status}, like the events of the built-in controllers, rather than by the
+   * message of fabric8, which wraps it with the request URL and a dump of the whole {@code
+   * Status}. fabric8 rethrows such a failure as a copy of itself which carries the original as its
+   * cause, so that cause is not repeated.
    *
    * @param throwable The exception to describe, may be null.
    * @return A description of the exception.
@@ -203,16 +210,31 @@ public static String describe(Throwable throwable) {
     if (throwable == null) {
       return "";
     }
-    StringBuilder builder = new StringBuilder(describeSingle(throwable));
+    String message = messageOf(throwable);
+    String description = describeSingle(throwable, message);
     Throwable rootCause = rootCauseOf(throwable);
-    if (rootCause != null) {
-      builder.append(", caused by: ").append(describeSingle(rootCause));
+    if (rootCause == null) {
+      return description;
+    }
+    String rootCauseMessage = messageOf(rootCause);
+    // A cause with the same message adds nothing but its type, e.g. the original of the copy which
+    // fabric8 rethrows, or the request timeout which it wraps.
+    if (StringUtils.isNotBlank(message) && message.equals(rootCauseMessage)) {
+      return description;
+    }
+    return description + ", caused by: " + describeSingle(rootCause, rootCauseMessage);
+  }
+
+  private static String messageOf(Throwable throwable) {
+    if (throwable instanceof KubernetesClientException e
+        && e.getStatus() != null
+        && StringUtils.isNotBlank(e.getStatus().getMessage())) {
+      return e.getStatus().getMessage();
     }
-    return builder.toString();
+    return throwable.getMessage();
   }
 
-  private static String describeSingle(Throwable throwable) {
-    String message = throwable.getMessage();
+  private static String describeSingle(Throwable throwable, String message) {
     String type = throwable.getClass().getSimpleName();
     return StringUtils.isBlank(message) ? type : type + ": " + message;
   }
 
@@ -84,8 +84,11 @@ protected StatusRecorder(
    * behavior.
    *
    * @param context Context of the resource for which status update should be performed.
+   * @param currentStateEventMessage The message of the event about the current state, or null for
+   *     the message of that state.
    */
-  private void patchAndStatusWithVersionLocked(BaseContext<CR> context) {
+  private void patchAndStatusWithVersionLocked(
+      BaseContext<CR> context, String currentStateEventMessage) {
     CR resource = context.getResource();
     KubernetesClient client = context.getClient();
     ObjectNode newStatusNode = objectMapper.convertValue(resource.getStatus(), ObjectNode.class);
@@ -139,7 +142,7 @@ private void patchAndStatusWithVersionLocked(BaseContext<CR> context) {
         listener -> {
           listener.listenStatus(resource, prevStatus, resource.getStatus());
         });
-    recordTransitionEvents(context, prevStatus, resource.getStatus());
+    recordTransitionEvents(context, prevStatus, resource.getStatus(), currentStateEventMessage);
   }
 
   /**
@@ -159,13 +162,17 @@ private void patchAndStatusWithVersionLocked(BaseContext<CR> context) {
    *
    * <p>The event type follows {@link EventUtils#eventTypeOf(BaseStateSummary)}. The state name is
    * used as both reason and dedup key, so an app that keeps re-entering the same state bumps the
-   * count on one Event instead of accumulating one per attempt.
+   * count on one Event instead of accumulating one per attempt. The message is the state message,
+   * unless a message is given for the event about the current state.
    *
    * @param context Context of the resource whose status has just been patched.
    * @param prevStatus The status before the patch, may be null.
    * @param status The status that was persisted.
+   * @param currentStateEventMessage The message of the event about the current state, or null for
+   *     the message of that state.
    */
-  private void recordTransitionEvents(BaseContext<CR> context, STATUS prevStatus, STATUS status) {
+  private void recordTransitionEvents(
+      BaseContext<CR> context, STATUS prevStatus, STATUS status, String currentStateEventMessage) {
     BaseState<?> currentState = status.getCurrentState();
     if (currentState == null
         || (prevStatus != null && currentState.equals(prevStatus.getCurrentState()))) {
@@ -175,7 +182,10 @@ private void recordTransitionEvents(BaseContext<CR> context, STATUS prevStatus,
     for (BaseState<?> state : newStatesSince(prevStatus, status)) {
       Object summary = state.getCurrentStateSummary();
       if (summary instanceof BaseStateSummary stateSummary && !summary.equals(lastSummary)) {
-        String message = state.getMessage();
+        String message =
+            currentStateEventMessage != null && state.equals(currentState)
+                ? currentStateEventMessage
+                : state.getMessage();
         EventUtils.record(
             context.getEventRecorder(),
             EventUtils.eventTypeOf(stateSummary),
@@ -219,9 +229,28 @@ private List<BaseState<?>> newStatesSince(STATUS prevStatus, STATUS status) {
    * @return true if the status is successfully patched.
    */
   public boolean persistStatus(BaseContext<CR> context, STATUS newStatus) {
+    return persistStatus(context, newStatus, null);
+  }
+
+  /**
+   * Persists the new status of the resource to the Kubernetes cluster, like {@link
+   * #persistStatus(BaseContext, BaseStatus)}, but publishes the given message in place of the
+   * message of the current state in the event about the transition into it. It is meant for a
+   * state message which is too detailed for an event, such as one which carries a stack trace,
+   * since events typically reach more readers than the resource status, e.g. through the built-in
+   * {@code view} ClusterRole or an event exporter.
+   *
+   * @param context The BaseContext containing the resource and client.
+   * @param newStatus The new status to persist.
+   * @param currentStateEventMessage The message of the event about the current state, or null for
+   *     the message of that state.
+   * @return true if the status is successfully patched.
+   */
+  public boolean persistStatus(
+      BaseContext<CR> context, STATUS newStatus, String currentStateEventMessage) {
     try {
       context.getResource().setStatus(newStatus);
-      patchAndStatusWithVersionLocked(context);
+      patchAndStatusWithVersionLocked(context, currentStateEventMessage);
       return true;
     } catch (KubernetesClientException e) {
       log.error("Error while persisting status to {}", newStatus, e);
 
@@ -1135,7 +1135,7 @@ void unsupportedKueueSpecFailsScheduling() {
     Assertions.assertEquals(ReconcileProgress.completeAndImmediateRequeue(), progress);
     Assertions.assertNull(getWorkload());
     ArgumentCaptor<ApplicationStatus> captor = ArgumentCaptor.forClass(ApplicationStatus.class);
-    verify(recorder).persistStatus(any(), captor.capture());
+    verify(recorder).persistStatus(any(), captor.capture(), any());
     Assertions.assertEquals(
         ApplicationStateSummary.SchedulingFailure,
         captor.getValue().getCurrentState().getCurrentStateSummary());
@@ -1638,16 +1638,25 @@ void driverMissingFromCacheWithUnbuildableSpecFailsScheduling() {
               throw new SparkException(
                   "Please specify spark.kubernetes.file.upload.path property.");
             });
-    when(recorder.persistStatus(any(), any())).thenReturn(true);
+    when(recorder.persistStatus(any(), any(), any())).thenReturn(true);
 
     ReconcileProgress progress = appInitStep.reconcile(mockContext, recorder);
 
     Assertions.assertEquals(ReconcileProgress.completeAndImmediateRequeue(), progress);
     ArgumentCaptor<ApplicationStatus> captor = ArgumentCaptor.forClass(ApplicationStatus.class);
-    verify(recorder).persistStatus(any(), captor.capture());
+    ArgumentCaptor<String> eventMessage = ArgumentCaptor.forClass(String.class);
+    verify(recorder).persistStatus(any(), captor.capture(), eventMessage.capture());
     Assertions.assertEquals(
         ApplicationStateSummary.SchedulingFailure,
         captor.getValue().getCurrentState().getCurrentStateSummary());
+    // The status keeps the stack trace, while the event only describes the failure
+    Assertions.assertTrue(
+        captor.getValue().getCurrentState().getMessage().contains("\tat "),
+        captor.getValue().getCurrentState().getMessage());
+    Assertions.assertEquals(
+        Constants.SCHEDULE_FAILURE_MESSAGE
+            + " SparkException: Please specify spark.kubernetes.file.upload.path property.",
+        eventMessage.getValue());
     Assertions.assertNotNull(getWorkload());
   }
 
@@ -1804,7 +1813,7 @@ void kueueFlavorConflictFailsSchedulingAndReleasesWorkload() {
     when(mockContext.getClient()).thenReturn(kubernetesClient);
     when(mockContext.getEventRecorder()).thenReturn(eventRecorder);
     createFlavor("spot-flavor", Map.of("pool", "spot"), List.of());
-    when(recorder.persistStatus(any(), any())).thenReturn(true);
+    when(recorder.persistStatus(any(), any(), any())).thenReturn(true);
 
     appInitStep.reconcile(mockContext, recorder);
     admitWorkload(Map.of("driver", Map.of("cpu", "spot-flavor")));
@@ -1815,7 +1824,7 @@ void kueueFlavorConflictFailsSchedulingAndReleasesWorkload() {
     Assertions.assertNull(getWorkload());
     verify(mockContext, never()).setKueuePodSetFlavors(any());
     ArgumentCaptor<ApplicationStatus> captor = ArgumentCaptor.forClass(ApplicationStatus.class);
-    verify(recorder).persistStatus(any(), captor.capture());
+    verify(recorder).persistStatus(any(), captor.capture(), any());
     Assertions.assertEquals(
         ApplicationStateSummary.SchedulingFailure,
         captor.getValue().getCurrentState().getCurrentStateSummary());
 
@@ -293,11 +293,19 @@ void rejectedRequestOfResourcesFailsScheduling() {
         ReconcileProgress.completeAndImmediateRequeue(),
         clusterInitStep.reconcile(mockContext, recorder));
     ArgumentCaptor<ClusterStatus> statusCaptor = ArgumentCaptor.forClass(ClusterStatus.class);
-    verify(recorder).persistStatus(any(), statusCaptor.capture());
+    ArgumentCaptor<String> eventMessage = ArgumentCaptor.forClass(String.class);
+    verify(recorder).persistStatus(any(), statusCaptor.capture(), eventMessage.capture());
     Assertions.assertEquals(
         ClusterStateSummary.SchedulingFailure,
         statusCaptor.getValue().getCurrentState().getCurrentStateSummary());
-    // The status already says why, so no event is needed
+    // The status keeps the stack trace, which the SchedulingFailure event leaves out
+    Assertions.assertTrue(
+        statusCaptor.getValue().getCurrentState().getMessage().contains("\tat "),
+        statusCaptor.getValue().getCurrentState().getMessage());
+    Assertions.assertEquals(
+        Constants.CLUSTER_SCHEDULE_FAILURE_MESSAGE + " KubernetesClientException: Invalid",
+        eventMessage.getValue());
+    // SchedulingFailure already says why, so no other event is needed
     verifyNoInteractions(eventRecorder);
   }
 
@@ -1082,7 +1090,7 @@ void kueueFlavorConflictFailsSchedulingAndReleasesWorkload() {
     verify(mockContext, never()).setKueuePodSetFlavors(any());
     verify(mockContext, never()).getMasterServiceSpec();
     ArgumentCaptor<ClusterStatus> captor = ArgumentCaptor.forClass(ClusterStatus.class);
-    verify(recorder).persistStatus(any(), captor.capture());
+    verify(recorder).persistStatus(any(), captor.capture(), any());
     Assertions.assertEquals(
         ClusterStateSummary.SchedulingFailure,
         captor.getValue().getCurrentState().getCurrentStateSummary());