What is the easiest way to setup LUKS on a new image?

I am maintaining an RHEL7 image in a VM. When I deploy it to a new machine, I will convert the VDI to a raw image, then DD it or I will use clonezilla.

I have a new requirement were some new machines require full disk encryption. I’ve always used hardware encryptable drives which I just enable in the bios.

This is my first time using LUKS. I have read there are several ways to encrypt, I can do the whole drive or each partition. I think I would prefer to do the whole drive.

Should I image the drive first, then attempt to enable encryption? Or is there a way to setup encryption first, then put the image on.

Note, after the image is installed, I typically use Gparted to resize the last partition to use up the rest of the disk space.