fluentd, output elasticsearch, how to add RootCa from k8s?

[marcin-github]

Hello!
I've got:

apiVersion: fluentd.fluent.io/v1alpha1
kind: ClusterOutput
metadata:
  name: fluentd-output-es
  labels:
    output.fluentd.fluent.io/enabled: "true"
spec:
  outputs:
  - elasticsearch:
      host: xxx-http.yyy-dev.svc
      port: 9200
      scheme: https

but fluentd is unhappy due to ssl certificate is untrusty. How can I pass RootCa of k8s to this kind of output?