The first step is to login to https://luv.dkrz.de to enter your personal DKRZ homepage and select “Join existing project”. Select project 1125: ICON-development. Use the message field to state the development group you belong to (mpim).

Your request has to be approved by one of the administrators, than you will receive a mail that you are added as a project member.

As next step you have to generate a key:

ssh-keygen -t ed25519 -C marlies.mustermann@mpimet.mpg.de -f ~/.ssh/id_rsa_gitlab

when asked provide a passphrase different to your LDAP password!

Now you can login to https://gitlab.dkrz.de In the upper right corner you'll find an icon where you can change your personal settings. Click on 'Settings'. On the left side you will now find 'SSH keys'. Here you can simply copy and paste your personal public key (id_rsa_gitlab.pub)

To use this key for gitlab you need to add in ~/.ssh/config

Host gitlab.dkrz.de
  ForwardX11 no
  ForwardX11Trusted no
  IdentityFile ~/.ssh/id_rsa_gitlab
  User git

And with thanks to Luis Kornblueh:

To avoid entering your passphrase several times when cloning the model add the following snippet to the end of your .bashrc

SSH_ENV="$HOME/.ssh/agent-environment"
trap '
    test -n "$SSH_AGENT_PID"  && eval `ssh-agent -k`
' 0
function start_agent {
    echo -n "Initialising new SSH agent ... "
    /usr/bin/ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}"
    echo succeeded
    chmod 600 "${SSH_ENV}"
    source "${SSH_ENV}" > /dev/null
    /usr/bin/ssh-add;
}
if [[ -f "${SSH_ENV}" ]]
then
    source "${SSH_ENV}" > /dev/null
    ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || {
        start_agent;
    }
else
    start_agent;
fi

Logout and login again: you should get the message

Initialising new SSH agent ... succeeded

If that did work, you can delegate your passphrase handling to the ssh-agent with

ssh-add ~/.ssh/id_rsa_gitlab

You will be asked for your passphrase only once and the rest will be done by the ssh-agent (per session/window).

Personal access tokens are an alternative way to authenticate. You can create an access token by clicking on your avatar and navigate to Edit profile → Access Tokens or by clicking the following link. Here you can modify the name, scope, and expiry date of the token. Select Create personal access token to create and display your personal token. The token is only shown once (!) and can be used like a normal password.

You can configure git to store your password (or token) to ease the authentication process in the future

git config --global credential.helper store

The credentials are stored in ~/.git-credentials.