In T253553 profile::java was created, which streamlines the installation and configuration of Java (picking the correct packages/repos depending on the target release, opting in to the hardened java.security config, passing Java opts centrally and more).
cergen (as used on primary puppet masters) should also switch to it.