Zero to Binder on GKE is 'unauthorized' when about to open a notebook

I have followed the Zero to Binder docs for the Google Kubernetes Engine. BinderHub is running, and I have attempted to open a recent repo from binder-examples. The build logs get almost to the end, and then fail.

Step 68/68 : CMD ["jupyter", "notebook", "--ip", ""]
 ---> Running in 70649d73a37c
Removing intermediate container 70649d73a37c
 ---> a9f9a2053cee
{"aux": {"ID": "sha256:a9f9a2053ceeaf62787113b39c2ed78b961357372bba223bcc8afe1ea5061e4c"}}Successfully built a9f9a2053cee
Successfully tagged
unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in:

It looks like your credentials aren’t setup correctly in BinderHub, or they don’t have permission to push to your GCR registry.

What roles are required? None are mentioned in the docs. I have “Kubernetes Engine Admin”, “Storage Admin”, and “Service Account User”.