I recently corrupted a CentOS hosted on OpenStack by adding an incorrect line in /etc/fstab, and CentOS prompts to me enter root password after a reboot. However in a cloud image, CentOS doesn't get a root password, and even password login is disabled by default.
To enter the single user mode for recovery, press e on grub starting and enter editing mode. Replace ro with rw init=/sysroot/init/bash in kernel line starting with linux16. Press Ctrl-x and check the log, this does work, but I still can't operate on console via noVNC.
After a search, the solution is also simple: editing the kernel line to tell the kernel only use one tty. That is, replace ro with rw /sysroot/init/bash console=tty, delete all the console parameter after and press Ctrl-x to boot.