Make it clear what to do if encryption/decryption fails about kubesec HOT 1 CLOSED

export TOKEN=$(gcloud beta auth application-default print-access-token)
# fill in PROJECT_ID, LOCATION_OF_KEYRING, KEYRING_NAME, KEY_NAME
curl -X POST -H "Content-Type: application/json" -d '{"permissions": ["cloudkms.cryptoKeyVersions.useToDecrypt","cloudkms.cryptoKeyVersions.useToEncrypt"]}' -H "Authorization: Bearer $TOKEN" https://cloudkms.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_OF_KEYRING/keyRings/KEYRING_NAME/cryptoKeys/KEY_NAME:testIamPermissions

{
  "permissions": [
    "cloudkms.cryptoKeyVersions.useToDecrypt",
    "cloudkms.cryptoKeyVersions.useToEncrypt"
  ]
}