neondatabase/neon · error

extension {} is not found

Error message

extension {} is not found

What it means

Thrown by RemoteExtSpec::get_ext() in neon's compute_api when the (possibly library-mapped) extension name is not present in either RemoteExtSpec.public_extensions or RemoteExtSpec.custom_extensions. These two lists are the allow-list of extensions this compute is permitted to use, so this error is an authorization/availability check, not a filesystem lookup: the extension is denied because it was never granted to this compute.

Source

Thrown at libs/compute_api/src/spec.rs:417

            real_ext_name = self
                .library_index
                .get(&lib_raw_name)
                .ok_or(anyhow::anyhow!("library {} is not found", lib_raw_name))?;
        }

        // Check if extension is present in public or custom.
        // If not, then it is not allowed to be used by this compute.
        if !self
            .public_extensions
            .as_ref()
            .is_some_and(|exts| exts.iter().any(|e| e == real_ext_name))
            && !self
                .custom_extensions
                .as_ref()
                .is_some_and(|exts| exts.iter().any(|e| e == real_ext_name))
        {
            return Err(anyhow::anyhow!("extension {} is not found", real_ext_name));
        }

        match self.extension_data.get(real_ext_name) {
            Some(_ext_data) => Ok((
                real_ext_name.to_string(),
                Self::build_remote_path(build_tag, pg_major_version, real_ext_name)?,
            )),
            None => Err(anyhow::anyhow!(
                "real_ext_name {} is not found",
                real_ext_name
            )),
        }
    }

    /// Get the architecture-specific portion of the remote extension path. We
    /// use the Go naming convention due to Kubernetes.
    fn get_arch() -> &'static str {
        match std::env::consts::ARCH {

View on GitHub (pinned to 8f60b04da4)

Solutions

1. Compare the requested extension name against public_extensions and custom_extensions in the RemoteExtSpec to confirm it is not allow-listed
2. Upload the extension as a custom extension for this project (or request it be made public) so it lands in the allow-list
3. Remove the CREATE EXTENSION / preload reference from the compute spec
4. Check for name typos and version-suffixed names (the comparison is exact string equality)

Example fix

-- before
CREATE EXTENSION pgcrypto;  -- not in public_extensions or custom_extensions

-- after
-- pick an allow-listed extension, e.g. from public_extensions:
CREATE EXTENSION pg_stat_statements;

// Allow-list check mirroring get_ext's gate:
fn extension_allowed(spec: &RemoteExtSpec, name: &str) -> bool {
    let listed = |opt: &Option<Vec<String>>| {
        opt.as_ref().is_some_and(|v| v.iter().any(|e| e == name))
    };
    listed(&spec.public_extensions) || listed(&spec.custom_extensions)
}

// Surface a clear 'extension not available for this tenant' message:
match spec.get_ext(name, false, tag, ver) {
    Ok(res) => res,
    Err(e) if e.to_string().starts_with("extension ") => {
        return Err(anyhow!("extension {name} is not enabled for this project; enable it via the control plane"));
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: get_ext("pgcrypto", false, ...) when pgcrypto is in neither the public nor the custom extension list of the spec; CREATE EXTENSION or a shared library mapped to an extension that is not allow-listed for the tenant/project.

Common situations: Tenant requesting an extension that is not in the platform's public extension set and was never uploaded as a custom extension; custom extension uploaded to a different project than the one running the compute; spec built from a stale extension availability list; typos in the extension name in the compute spec.

Related errors

• library {} is not found
• real_ext_name {} is not found
• pg_ctl failed, exit code: {}, stdout: {}, stderr: {}
• no grpc_url for shard {shard_index}
• no libpq_url for shard {shard_index}

AI-assisted analysis of neondatabase/neon@8f60b04da4 (2026-08-16). Data as JSON: /api/errors/248ab1cdd2aea221. Report an issue: GitHub.