Ensure default service account is correctly set for Genkit monitoring IAM bindings:Fixes issue where an empty string could result in malformed IAM member serviceAccount: by properly checking index and replacing with the default service account. (#8760)

Co-authored-by: joehan <[email protected]>

Author: prabalp

src/deploy/functions/checkIam.ts

@@ -206,11 +206,11 @@ export async function ensureGenkitMonitoringRoles(
     .map((endpoint) => endpoint.serviceAccount || "")
     .filter((value, index, self) => self.indexOf(value) === index);
   const defaultServiceAccountIndex = serviceAccounts.indexOf("");
-  if (defaultServiceAccountIndex) {
+  if (defaultServiceAccountIndex !== -1) {
     serviceAccounts[defaultServiceAccountIndex] = await gce.getDefaultServiceAccount(projectNumber);
   }
 
-  const members = serviceAccounts.map((sa) => `serviceAccount:${sa}`);
+  const members = serviceAccounts.filter((sa) => !!sa).map((sa) => `serviceAccount:${sa}`);
   const requiredBindings: iam.Binding[] = [];
   for (const monitoringRole of GENKIT_MONITORING_ROLES) {
     requiredBindings.push({