There's a new feature in ingress-nginx 1.12 that allows you to filter annotations by risk using annotations-risk-level. Use annotations-risk-level: Critical to allow allow-snippet-annotations: true.

For further reference you can check this blog and discussion.