For me the issue is even deeper.
I'm not striving for Secure Boot, just for UEFI with encrypted `/boot`.
However, even when `/boot/grub/grub.cfg` contains lines with `insmod luks` and `insmod cryptodisk` (I've tried even both `GRUB_ENABLE_CRYPTODISK=y` and `GRUB_PRELOAD_MODULES="luks cryptodisk"` at the same time), resulting `/boot/efi/EFI/ubuntu/grubx64.efi` (on ESP partition, of course) doesn't have those modules embedded and thus falls back to console without possibility to actually boot the system.
I feel like modules bundling is broken, since, for instance, BTRFS driver is always bundled independently from whether I use BTRFS or ext4.
For me the issue is even deeper.
I'm not striving for Secure Boot, just for UEFI with encrypted `/boot`.
However, even when `/boot/ grub/grub. cfg` contains lines with `insmod luks` and `insmod cryptodisk` (I've tried even both `GRUB_ENABLE_ CRYPTODISK= y` and `GRUB_PRELOAD_ MODULES= "luks cryptodisk"` at the same time), resulting `/boot/ efi/EFI/ ubuntu/ grubx64. efi` (on ESP partition, of course) doesn't have those modules embedded and thus falls back to console without possibility to actually boot the system.
I feel like modules bundling is broken, since, for instance, BTRFS driver is always bundled independently from whether I use BTRFS or ext4.