The URL for console access is generated from a property that is set on each compute node. Look at the nova.conf file on one of your compute nodes for the novncproxy_base_url property:

novncproxy_base_url=http://control.example.com:6080/vnc_auto.html

This base URL is the address of the nova-novncproxy service that will be able to create a console connection to the instance. In the web interface, this URL is retrieved for you when you select the console tab for an instance. At the command line, you can use Nova's get-vnc-console and pass the novnc type to get the console URL:

$ nova console url show --novnc {instance-id}

This will return a URL that will include base_url from the compute node the instance is running on and an authentication token to access the console with. If you paste this URL into a web browser, there are a few steps that happen under the hood to connect you to the instance's console.

First, you need to be able to connect to nova-novncproxy. This runs by default on port 6080 on the control tier. Once the request to connect to the instance's console is established, the token that is passed in the URL is passed to nova-consoleauth and validated in nova-cert. If all that succeeds, then the connection to the instance on the compute is established and the console is provided through the web browser.

If you are having trouble with console connections, make sure that the base URL is pointing to the nova-novncproxy service, and that you can connect to the nova-novncproxy service. If you see a console window, but the console is not being displayed, then you need to check that nova-consoleauth and nova-cert are running and check the logs for errors in validating the token. If there aren't any errors in validating the token, check the nova-novncproxy log to ensure that a connection to the instance can be made.