Problem when reconciling cluster on Hetzner with private-only networks

I'm following the getting KubeOne tutorial, adapted for Hetzner with private-only networking and using an existing private network, which requires a cloud-init config for the machines.
I'm trying to create some worker nodes using this deployment.

kind: MachineDeployment
metadata:
  annotations:
    cluster_autoscaler_max_replicas: "2"
    cluster_autoscaler_min_replicas: "2"
    k8c.io/operating-system-profile: ubuntu
  name: test-k8s-pool1
  namespace: kube-system
spec:
  minReadySeconds: 0
  replicas: 2
  selector:
    matchLabels:
      workerset: test-k8s-pool1
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        workerset: test-k8s-pool1
      namespace: kube-system
    spec:
      metadata:
        labels:
          workerset: test-k8s-pool1
      providerSpec:
        value:
          cloudProvider: hetzner
          cloudProviderSpec:
            image: ubuntu-24.04
            location: nbg1
            networks:
            - <REDACTED> # would be a hetzner network id
            serverType: cx22
          operatingSystem: ubuntu
          operatingSystemSpec:
            distUpgradeOnBoot: false
          sshPublicKeys:
          - <REDACTED>
      versions:
        kubelet: 1.29.4

Therefore, applying this deployment to the cluster gets me this set of logs:

{"level":"info","time":"2025-06-11T20:18:15.880Z","logger":"machineset-controller","caller":"machineset/controller.go:254","msg":"Too few replicas, creating more","machineset":"kube-system/test-k8s-pool-1-5b76546f67","spec":1,"current":0,"diff":1}
{"level":"info","time":"2025-06-11T20:18:15.880Z","logger":"machineset-controller","caller":"machineset/controller.go:259","msg":"Creating new machine","machineset":"kube-system/test-k8s-pool-1-5b76546f67","spec":1,"current":0,"index":1}
{"level":"error","time":"2025-06-11T20:18:15.961Z","logger":"machinedeployment-controller","caller":"machinedeployment/controller.go:130","msg":"Reconciling failed","machinedeployment":"kube-system/test-k8s-pool-1","error":"Operation cannot be fulfilled on machinedeployments.cluster.k8s.io \"test-k8s-pool-1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","time":"2025-06-11T20:18:16.008Z","logger":"machine-controller","caller":"machine/controller.go:813","msg":"cloud-init configuration: cloud config is not ready yet","machine":"kube-system/test-k8s-pool-1-5b76546f67-hktff","provider":"hetzner","secret":"bootstrap"}
{"level":"error","time":"2025-06-11T20:18:19.100Z","logger":"machine-controller","caller":"machine/controller.go:813","msg":"cloud-init configuration: cloud config is not ready yet","machine":"kube-system/test-k8s-pool-1-5b76546f67-hktff","provider":"hetzner","secret":"bootstrap"} <- and this one keeps repeating

No new machines are created in Hetzner and I would like to see the source of the problem in the logs.
Is there an oversight in the configuration, or could you point me to a documentation I should follow?

Also, is there a way to enable debug logging for this controller?

Start with machine/controller.go around the reported cloud-init error, then trace the Hetzner provider path and the bootstrap secret readiness. Review the related machinedeployment and machineset controller logs to distinguish configuration from reconciliation behavior. Done means identifying the cause, showing useful debug output, and documenting or fixing the reproducible case with a test if applicable.