I've added —-runtime-config=batch/v2alpha1=true to the kube-apiserver config like so:

      ... other stuff
      command:
        - "/hyperkube"
        - "apiserver"
        - "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
        - "--address=0.0.0.0"
        - "--allow-privileged"
        - "--insecure-port=8080"
        - "--secure-port=443"
        - "--cloud-provider=azure"
        - "--cloud-config=/etc/kubernetes/azure.json"
        - "--service-cluster-ip-range=10.0.0.0/16"
        - "--etcd-servers=http://127.0.0.1:2379"
        - "--etcd-quorum-read=true"
        - "--advertise-address=10.240.255.15"
        - "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt"
        - "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--client-ca-file=/etc/kubernetes/certs/ca.crt"
        - "--service-account-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--storage-backend=etcd2"
        - "--v=4"
        - "—-runtime-config=batch/v2alpha1=true"
        ... etc

but after restarting the master kubectl api-versions still shows only batch/v1, no v2alpha1 to be seen.

$ kubectl api-versions
apiextensions.k8s.io/v1beta1
apiregistration.k8s.io/v1beta1
apps/v1beta1
authentication.k8s.io/v1
authentication.k8s.io/v1beta1
authorization.k8s.io/v1
authorization.k8s.io/v1beta1
autoscaling/v1
batch/v1
certificates.k8s.io/v1beta1
extensions/v1beta1
networking.k8s.io/v1
policy/v1beta1
rbac.authorization.k8s.io/v1alpha1
rbac.authorization.k8s.io/v1beta1
settings.k8s.io/v1alpha1
storage.k8s.io/v1
storage.k8s.io/v1beta1
v1

Here's my job definition:

kind: CronJob
apiVersion: batch/v2alpha1
metadata:
  name: mongo-backup
spec:
  schedule: "* */1 * * *"
  jobTemplate:
    spec:
... etc

And the error I get when I try to create the job:

$ kubectl create -f backup-job.yaml                 
error: error validating "backup-job.yaml": error validating data: unknown object type schema.GroupVersionKind{Group:"batch", Version:"v2alpha1", Kind:"CronJob"}; if you choose to ignore these errors, turn validation off with --validate=false
$ kubectl create -f backup-job.yaml --validate=false
error: unable to recognize "backup-job.yaml": no matches for batch/, Kind=CronJob

What else do I need to do?

PS. this is on Azure ACS, I don't think it makes a difference though.