I understand EUA is going away.. that's fine.. but in its current state, istioctl does not properly validate the policies section. It seems to require namespace field as in:

apiVersion: config.istio.io/v1alpha2
kind: EndUserAuthenticationPolicySpecBinding
metadata:
  name: cars-api-auth-policy-binding
  namespace: tutorial
spec:
  policies:
    - name: cars-api-auth-policy
      namespace: tutorial
  services:
    - name: cars-api
      namespace: tutorial

If I leave the namespace field out, it doesn't properly recognize the binding. This should be validated in istioctl for EUA and whatever the successor is.