@@ -164,13 +164,22 @@ affect building the project, CI, tests or examples.
   labels in `spec.driverServiceIngressList` (`serviceMetadata`, `ingressMetadata`),
   `spec.driverHttpRouteList` (`serviceMetadata`, `httpRouteMetadata`), `spec.driverGrpcRouteList`
   (`serviceMetadata`, `grpcRouteMetadata`) and `spec.configMapSpecs`, as well as the other
-  Kubernetes resources of the driver, e.g. its config map and on-demand PVCs. 1.0 overwrote these
-  labels with the driver-pod labels of the same key, including the ones injected into the driver pod
-  by admission webhooks. The operator- and Spark-managed identity labels, i.e. any `spark.operator/`
+  Kubernetes resources of the driver, e.g. its service with `spark.kubernetes.driver.service.label.*`
+  and its on-demand PVCs with `spark.kubernetes.driver.volumes.persistentVolumeClaim.<name>.label.*`.
+  1.0 overwrote these labels with the driver-pod labels of the same key, including the ones injected
+  into the driver pod by admission webhooks. The operator- and Spark-managed identity labels, i.e. any `spark.operator/`
   key, `spark-role`, `spark-version`, `spark-app-selector` and `spark-app-name`, still take the
-  driver-pod value, so the secondary-to-primary mapping and the pod and service selectors keep
-  working. To restore the behavior before 1.1.0 for a given key, remove it from the secondary
-  resource so it inherits the driver-pod label.
+  driver-pod value, since they identify the resources of an application, e.g. Spark deletes its
+  services, PVCs and executor config maps by `spark-app-selector` and `spark-role`. To restore the
+  behavior before 1.1.0 for a given key, remove it from the secondary
+  resource so it inherits the driver-pod label. Note that Spark substitutes `{{APP_ID}}` only in
+  driver pod labels (`spark.kubernetes.driver.label.*`), not in driver service labels
+  (`spark.kubernetes.driver.service.label.*`) or PVC labels
+  (`spark.kubernetes.driver.volumes.persistentVolumeClaim.<name>.label.*`). A raw `{{APP_ID}}` in
+  those is therefore no longer replaced with the substituted driver-pod value, producing an invalid
+  label value that the API server rejects with `422`, so the application fails with
+  `SchedulingFailure`. Set such a label on the driver pod only, and let the resource inherit the
+  substituted value.
 
 ### SparkCluster
 
 
@@ -19,20 +19,16 @@
 
 package org.apache.spark.k8s.operator.decorators;
 
-import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_APPLICATION_NAME;
 import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_APP_NAME;
 import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_APP_SELECTOR;
-import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_OPERATOR_NAME;
 import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_ROLE_NAME;
 import static org.apache.spark.k8s.operator.Constants.LABEL_SPARK_VERSION_NAME;
 import static org.apache.spark.k8s.operator.utils.ModelUtils.buildOwnerReferenceTo;
 
 import java.util.Map;
 import java.util.Set;
-import java.util.stream.Collectors;
 
 import io.fabric8.kubernetes.api.model.HasMetadata;
-import io.fabric8.kubernetes.api.model.ObjectMeta;
 import io.fabric8.kubernetes.api.model.ObjectMetaBuilder;
 import io.fabric8.kubernetes.api.model.OwnerReference;
 import io.fabric8.kubernetes.api.model.Pod;
@@ -57,14 +53,11 @@ public class DriverResourceDecorator implements ResourceDecorator {
 
   /**
    * Operator- and Spark-managed identity labels whose driver-pod value must always propagate to
-   * secondary resources unchanged. A resource's own label of the same key
-   * must never override them. Any label key under the {@value #MANAGED_LABEL_PREFIX} prefix is
-   * protected the same way (which already covers the operator-namespaced keys listed here).
+   * secondary resources unchanged. A resource's own label of the same key must never override them.
+   * Any label key under the {@value #MANAGED_LABEL_PREFIX} prefix is protected the same way.
    */
   private static final Set<String> MANAGED_LABEL_KEYS =
       Set.of(
-          LABEL_SPARK_OPERATOR_NAME,
-          LABEL_SPARK_APPLICATION_NAME,
           LABEL_SPARK_ROLE_NAME,
           LABEL_SPARK_VERSION_NAME,
           LABEL_SPARK_APP_SELECTOR,
@@ -102,34 +95,21 @@ public <T extends HasMetadata> T decorate(T resource) {
     }
     if (!ownerReferenceExists) {
       log.debug("Adding OwnerReference to driver for secondary resource");
-      ObjectMeta metaData =
+      Map<String, String> resourceLabels = resource.getMetadata().getLabels();
+      ObjectMetaBuilder builder =
           new ObjectMetaBuilder(resource.getMetadata())
-              .addToOwnerReferences(buildOwnerReferenceTo(driverPod))
-              .addToLabels(driverPod.getMetadata().getLabels())
-              .addToLabels(overridableLabels(resource.getMetadata().getLabels()))
-              .build();
-      resource.setMetadata(metaData);
+              .addToOwnerReferences(buildOwnerReferenceTo(driverPod));
+      driverPod.getMetadata().getLabels().forEach((key, value) -> {
+        boolean resourceSetsKey = resourceLabels != null && resourceLabels.containsKey(key);
+        if (isManagedLabel(key) || !resourceSetsKey) {
+          builder.addToLabels(key, value);
+        }
+      });
+      resource.setMetadata(builder.build());
     }
     return resource;
   }
 
-  /**
-   * Filters the resource's own labels down to the ones that are allowed to override a driver-pod
-   * label of the same key, dropping operator- and Spark-managed identity labels (see {@link
-   * #MANAGED_LABEL_KEYS} and {@link #MANAGED_LABEL_PREFIX}).
-   *
-   * @param resourceLabels the resource's own labels (may be {@code null}).
-   * @return the subset of labels safe to re-apply on top of the driver-pod labels.
-   */
-  private static Map<String, String> overridableLabels(Map<String, String> resourceLabels) {
-    if (resourceLabels == null || resourceLabels.isEmpty()) {
-      return Map.of();
-    }
-    return resourceLabels.entrySet().stream()
-        .filter(entry -> !isManagedLabel(entry.getKey()))
-        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
-  }
-
   /**
    * Returns whether the given label key is operator- or Spark-managed and must therefore keep the
    * driver-pod value rather than be overridden by the resource.
 
@@ -50,6 +50,9 @@ private static Pod driverPod() {
         .addToLabels("spark.operator/submission-id", "sub-1")
         .addToLabels(LABEL_SPARK_ROLE_NAME, "driver")
         .addToLabels("spark-app-selector", "spark-app-selector-1")
+        .addToLabels("spark-version", "4.2.0")
+        .addToLabels("spark-app-name", "app1-name")
+        .addToLabels("driver-only-label", "driver-value")   // neutral driver only label
         .addToLabels("overlapping-label", "driver-value")
         .endMetadata()
         .build();
@@ -66,12 +69,18 @@ private static Service service(Map<String, String> labels) {
   }
 
   /**
-   * Driver-pod labels whose key is absent on the resource are propagated onto the resource, while a
-   * label the resource sets itself still wins on key collision (e.g. a per-service waypoint label).
+   * Driver-pod labels whose key is absent on the resource are propagated onto the resource
+   * (including a neutral driver-only label), a label the resource sets itself wins on a key
+   * collision, and a neutral label only the resource sets is
+   * kept.
    */
   @Test
   void driverLabelsPropagatedAndResourceLabelWinsOnCollision() {
-    Service service = service(Map.of("overlapping-label", "resource-value"));
+    Service service =
+        service(
+            Map.of(
+                "overlapping-label", "resource-value",
+                "resource-only-label", "resource-value"));
 
     new DriverResourceDecorator(driverPod()).decorate(service);
 
@@ -82,7 +91,11 @@ void driverLabelsPropagatedAndResourceLabelWinsOnCollision() {
             "spark.operator/submission-id", "sub-1",
             LABEL_SPARK_ROLE_NAME, "driver",
             "spark-app-selector", "spark-app-selector-1",
-            "overlapping-label", "resource-value"),
+            "spark-version", "4.2.0",
+            "spark-app-name", "app1-name",
+            "driver-only-label", "driver-value",
+            "overlapping-label", "resource-value",
+            "resource-only-label", "resource-value"),
         service.getMetadata().getLabels());
   }
 
@@ -102,8 +115,8 @@ void resourceWithoutLabelsInheritsDriverPodLabels() {
 
   /**
    * Managed identity labels (exact-match keys and anything under the {@code spark.operator} prefix)
-   * must keep the driver-pod value even when the resource sets a different value, so owner mapping
-   * and selectors are preserved, while a non-managed label is still allowed to win.
+   * must keep the driver-pod value even when the resource sets a different value, while a
+   * non-managed label is still allowed to win.
    */
   @Test
   void managedLabelsAreNotOverriddenByResource() {
@@ -115,6 +128,8 @@ void managedLabelsAreNotOverriddenByResource() {
                 "spark.operator/submission-id", "rogue-sub",
                 LABEL_SPARK_ROLE_NAME, "rogue-role",
                 "spark-app-selector", "rogue-selector",
+                "spark-version", "rogue-version",
+                "spark-app-name", "rogue-app-name",
                 "overlapping-label", "resource-value"));
 
     new DriverResourceDecorator(driverPod()).decorate(service);
@@ -126,6 +141,9 @@ void managedLabelsAreNotOverriddenByResource() {
             "spark.operator/submission-id", "sub-1",
             LABEL_SPARK_ROLE_NAME, "driver",
             "spark-app-selector", "spark-app-selector-1",
+            "spark-version", "4.2.0",
+            "spark-app-name", "app1-name",
+            "driver-only-label", "driver-value",
             "overlapping-label", "resource-value"),
         service.getMetadata().getLabels());
   }