Which service account have you associated with the Cloud Build trigger? In case it’s a custom service account, you can follow this thread to assign it the appropriate roles. You can also review [here the Container Registry permissions required to perform specific actions on your registries (pull, push, etc).