With Encryption at REST enabled on a MariaDB (10.4) database, can you change the Collation of all tables without unencrypting the database e.g:
alter table <some_table> convert to character set utf8mb4 collate utf8mb4_unicode_ci
OR does the database need to be decrypted before changing the collation?
As the ALTER TABLE statement cannot be done without reading the table, aka ALGORITHM=INSTANT (proof by fiddle) decryption will be performed as part of the alteration.
To validate the character set of existing data, and potentially convert it, and to reindex columns based on potentially a new collation, data does need to be read.
The data at rest encryption is transparent, so provided the key for the table is available it will happen automatically.
