Encrypting an Existing Cluster
Encryption at rest is applied at the storage-engine level, so existing plaintext data files cannot be encrypted in place. You enable it by rebuilding each node's data through an initial sync, one member at a time, with no downtime.
Before you start, you can query the encryption state of each node.
Initially, this will be set to false.
mongosh --port <port> --eval 'db.serverStatus().encryptionAtRest'
{ encryptionEnabled: false }
Procedure
Do this procedure one member at a time, always keeping a healthy majority so the cluster stays writable. The general approach is to take a secondary out, wipe its data directory, and restart it with encryption enabled so it re-syncs from the cluster and writes its copy encrypted. Roll through every member, primary last.
1. Encrypt each secondary, one at a time
Firstly, identify the list of secondaries in your cluster.
mongosh --port 27017 --eval 'rs.status().members.map(m => m.name + " " + m.stateStr)'
[ 'replica-set-node1:27017 PRIMARY', 'replica-set-node2:27018 SECONDARY', 'replica-set-node3:27019 SECONDARY' ]
Gracefully stop the secondary:
mongosh --port <secondary-port> --eval 'db.getSiblingDB("admin").shutdownServer()'
Wipe its data directory so it is forced to perform a full initial sync when it re-joins the cluster:
rm -rf /path/to/dbPath/*
Start the node with the enableEncryption configuration added, as defined in the
Configure MongoDB guide.
It rejoins and re-syncs from the cluster, writing all data encrypted on disk.
Wait until rs.status() shows the member back as a healthy SECONDARY before continuing.
2. Verify the node is encrypted
Follow this section in the installation guide to check that the data on the node is now encrypted at rest.
3. Repeat for all remaining secondaries
Repeat the encryption and verification steps for all other secondary nodes.
4. Encrypt the primary last
Step down the primary and let the cluster elect a new one:
mongosh --port <primary-port> --eval 'rs.stepDown()'
Once a new PRIMARY is in place, apply steps 1 and 2 to the stepped-down member.
After completion
Every data-bearing member should now pass the canary check.
Encryption at rest is per-node and not enforced across the cluster. Until the roll is complete, the un-encrypted members still hold plaintext copies on disk. The cluster is only fully protected once every member has been rebuilt and verified - check all members, not just the primary.