There does not appear to be a guide for enabling on-disk encryption for existing deployments in Cloud or Ops Manager.

Ostensibly, the process is quite straight-forward (for replica-sets); take out one member at a time, change the settings, delete the dbpath to force an initial sync, then start it up and wait for initial sync to finish. Rinse, repeat.

It would be nice to document this process.