I'm facing similar issue like @terraform-ftw
I even added Artifact Registry Reader to ALL of my service accounts - Still, no positive result
I even tried the solution proposed by @xab , but there's no such a a thing like "Nodes" tab in single cluster's page image

The response some sort of cloud worker is getting is 403 Forbidden as logs suggest (kubectl describe [podName])

(I've altered some details in the logs but I hope everyone gets what are they about):

  Warning  Failed     7m8s (x4 over 8m33s)    kubelet                                Failed to pull image "us-docker.pkg.dev/{MyProjectId}/docker-images/{MyImageName}:latest": failed to pull and unpack image "us-docker.pkg.dev/{MyProjectId}/docker-images/{MyImageName}:latest": failed to resolve reference "us-docker.pkg.dev/{MyProjectId}/docker-images/{MyImageName}:latest": failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://(******)%3Apull&service=us-docker.pkg.dev: 403 Forbidden