I was looking through the docs this morning and I couldn't find an option to enable root drive encryption for my nodegroups. What am I missing?

Someone else may have more definitive answer - but my understanding was that this was a property determined by the AMI you choose. Some AMIs include an encrypted root volume, others do not.

ah ok. I will look into that. Thanks!