Linux – LVM: Two or more volume groups (VGs) on one physical volume (PV)

Which one is better?

They are both using the same technology. If you encrypt the physical volume, then everything inside the LVM will be encrypted. If you need/want somethings to not be encrypted within your LVM volume then you would need to leave setup encryption on the logical volumes.

I'm afraid that by encrypting something I might be only encrypting some kind of metadata table and not the actual contents of my files.

Almost all installers basically setup a DM-Crypt volume using LUKS. This encrypts the contents of the entire partition. Then it is pretty common to setup LVM within the encrypted volume to provide the user the flexibility to adjust partitions as needed.

Is there any case where I'll want to have PV encryption + LV encryption?

I suppose if you were extremely paranoid, you might want to have your standard low-security volume that has the OS and your standard files. Then you might hide your extremely-super-double-plus-good-top-secret files inside a separate encrypted volume that you only mount as-needed. If you were mounting both volumes at boot, then it wouldn't make any sense at all, you would just have overhead of encrypted things twice, and not much real gain. If you did setup something like this, it should be pretty obvious that you would need to establish completely separate keys/passwords for the internal volume.

You should also be able to extend the existing partition (which is a "physical volume"). First resize the partition using fdisk or whatever, then run pvresize /dev/partition . See man pvresize.

Note: you probably can't convince the kernel to notice first the increased disc size, and if you can, then after modifing the partition table, you'll need to convince the kernel to re-read the partition table which you probably can't do either. A reboot is a sure way. So, first resize the disc from the virtual host, then reboot. Resize the partition with fdisk, reboot. Then run pvresize. If you need to do this without reboots, then the best way is just to add a new disk to the VM. That can be detected for sure without a reboot.