diff --git a/pkg/credentialprovider/keyring.go b/pkg/credentialprovider/keyring.go
index bab19a62cfa..5ca9c55cf13 100644
--- a/pkg/credentialprovider/keyring.go
+++ b/pkg/credentialprovider/keyring.go
@@ -108,11 +108,20 @@ const defaultRegistryHost = "index.docker.io/v1/"
 func isDefaultRegistryMatch(image string) bool {
 	parts := strings.SplitN(image, "/", 2)
 
+	if len(parts[0]) == 0 {
+		return false
+	}
+
 	if len(parts) == 1 {
 		// e.g. library/ubuntu
 		return true
 	}
 
+	if parts[0] == "docker.io" || parts[0] == "index.docker.io" {
+		// resolve docker.io/image and index.docker.io/image as default registry
+		return true
+	}
+
 	// From: http://blog.docker.com/2013/07/how-to-use-your-own-registry/
 	// Docker looks for either a “.” (domain separator) or “:” (port separator)
 	// to learn that the first part of the repository name is a location and not
diff --git a/pkg/credentialprovider/keyring_test.go b/pkg/credentialprovider/keyring_test.go
index 412d283c91a..88ceeea727f 100644
--- a/pkg/credentialprovider/keyring_test.go
+++ b/pkg/credentialprovider/keyring_test.go
@@ -413,6 +413,26 @@ func TestKeyringHitWithQualifiedDockerHub(t *testing.T) {
 	}
 }
 
+func TestIsDefaultRegistryMatch(t *testing.T) {
+	samples := []map[bool]string{
+		{true: "foo/bar"},
+		{true: "docker.io/foo/bar"},
+		{true: "index.docker.io/foo/bar"},
+		{true: "foo"},
+		{false: ""},
+		{false: "registry.tld/foo/bar"},
+		{false: "registry:5000/foo/bar"},
+		{false: "myhostdocker.io/foo/bar"},
+	}
+	for _, sample := range samples {
+		for expected, imageName := range sample {
+			if got := isDefaultRegistryMatch(imageName); got != expected {
+				t.Errorf("Expected '%s' to be %s, got %s", imageName, expected, got)
+			}
+		}
+	}
+}
+
 type testProvider struct {
 	Count int
 }