If anyone else finds this, I had to add "Storage Admin" permissions to my service account.
Now... I've since down a destroy and rebuilt my architecture from scratch and this is. the only part that's stopped working again. I can't deploy any of my containers to the registry.