Hey team, could you look at this? I can confirm the bug with 4.1.0 (I didn't use CORS with earlier versions).

The following config was entirely ignored and the CORS extension only used the annotation value:

kumuluzee:
  cors-filter:
    annotations:
      my-resource:
        allow-origin: "https://kumuluz.com"

Debugging and fiddling around, I found the workaround below. However, given that the Kumuluz CORS docs suggest using the nested YAML syntax, this is neither obvious nor really feasible.

kumuluzee:
  cors-filter.annotations.my-resource: arbitrary
  cors-filter.annotations.my-resource.allow-origin: "https://kumuluz.com"

Also, speaking of the docs: reading the source, I was surprised to find that setting any CORS config property for a resource makes Kumuluz ignore all annotation values, not just the one corresponding to the property. While that behavior makes sense, it should definitely be documented explicitly!

We will have a look and fix the issue. Thanks for the feedback.