Currently we have a venv workaround for lack of certbot in CentOS10 (encapsulated in scale_certbot_hack cookbook).
Once https://bugzilla.redhat.com/show_bug.cgi?id=2325246 is closed, we can move to the proper certbot package and then also move to fb_letsencrypt (there's a separate Issue for that).