how about leaving the new disk unencrypted and choosing "LVM-thin" option,
I am using ZFS exclusively, so I can not (and should not) say much about the other storage solutions.
...then encrypting from each VM where it is used? Do you think it is safe?
Encrypting a disk from the inside of a VM? Sounds wrong
to me as it adds additional attack vectors and key management problems. From my personal point of view the host should handle encryption. (My VMs are
my VMs - it may be different if you have customers who
manage their own VMs on your server.)
But it always depends on which attack scenario you are examining. (And there are
multiple.) If the attacker already controls the host he can "see" you unlocking the VM. But it may be sufficient for "all hosts were stolen and the thieves shall not be able to start/decrypt that VM".
Sorry, I am no specialist for this. The only FDE (Full-Disk-Encryption) I actually use is for all Laptops (may get stolen) and for my Qubes-OS workstations. In my PVE context only the backups are always encrypted, as they leave the cluster.
----
Edit: one step sideways. What I
did do some years ago was to evaluate Tang+Clevis,
https://github.com/latchset/clevis. That would be a really small server on a separate location. As long as
that Tang server was reachable from my to-be-secured host it could start and decrypt itself fully automatically - so
no manual user interaction was required. As soon as the system would get stolen it would not be able to connect to Tang and the whole data would stay encrypted. This worked great and it felt really elegant. And it should be possible to implement it on a PVE node, in the moment
before offering storage to PVE. I did
not do that yet because... I
think I am physically safe. Maybe I should reexamine that topic...
