When you create an instance with a keypair, Nova will make the public key available to the instance via the metadata server and/or the config-drive. On the instance, some software needs to pick up the key and add it to the authorized_hosts file. Normally, this software is cloud-init.

The keypair has nothing to do with the password. In fact, you use keypairs so that you don't need passwords.