It seems there's a gap between the cluster-api provider and rke2 itself https://docs.rke2.io/install/containerd_registry_configuration

configs:
  "<http://registry.example.com:5000|registry.example.com:5000>":
    auth:
      username: xxxxxx # this is the registry username
      password: xxxxxx # this is the registry password

vs the below that yields that you are missing the tls part of the secret

privateRegistriesConfig:
    configs:
      <http://registry.bar.com|registry.bar.com>:
        authSecret:
          apiVersion: v1
          kind: Secret
          namespace: kube-system
          name: registry-regcred