When working with personal access tokens or from within the gitlab-runner, you might run into Permission denied (publickey) errors. If you are using GitLab 8.12+ and your submodule is on the same GitLab server, you must update your .gitmodules file to use relative URLs.
From the relevant documentation:
If you are using GitLab 8.12+ and your submodule is on the same GitLab server, you must update your .gitmodules file to use relative URLs. Since Git allows the usage of relative URLs for your .gitmodules configuration, this easily allows you to use HTTP(S) for cloning all your CI jobs and SSH for all your local checkouts. The .gitmodules would look like:
path = project
url = ../../group/project.git